fix(public): 修复用户可见性、额度、验证与 Codex 探测

apps/aether-gateway/src/data/state/auth.rs

@@ -17,6 +17,13 @@ use aether_data::repository::auth::{
     read_resolved_auth_api_key_snapshot_by_user_api_key_ids,
 };
 
+#[derive(Debug, Clone, Default)]
+pub(crate) struct GatewayUserEffectiveListPolicies {
+    pub(crate) allowed_providers: Option<Vec<String>>,
+    pub(crate) allowed_api_formats: Option<Vec<String>>,
+    pub(crate) allowed_models: Option<Vec<String>>,
+}
+
 impl GatewayDataState {
     pub(crate) async fn is_other_user_auth_email_taken(
         &self,
@@ -1732,29 +1739,9 @@ impl GatewayDataState {
             apply_admin_unrestricted_auth_snapshot(&mut snapshot);
             return Ok(Some(snapshot));
         }
-        let mut groups = repository
+        let groups = self
-            .list_user_groups_for_user(&snapshot.user_id)
+            .effective_user_groups_for_user(&snapshot.user_id)
             .await?;
-        let dynamic_group_ids = self
-            .active_membership_group_ids_for_user(&snapshot.user_id)
-            .await?;
-        if !dynamic_group_ids.is_empty() {
-            groups.extend(
-                repository
-                    .list_user_groups_by_ids(&dynamic_group_ids)
-                    .await?,
-            );
-            let mut deduped = std::collections::BTreeMap::new();
-            for group in groups {
-                deduped.insert(group.id.clone(), group);
-            }
-            groups = deduped.into_values().collect();
-        }
-        groups.sort_by(|left, right| {
-            left.name
-                .cmp(&right.name)
-                .then_with(|| left.id.cmp(&right.id))
-        });
 
         let mut allowed_providers =
             resolve_effective_list_policy(None, "unrestricted", &groups, |group| {
@@ -1798,6 +1785,80 @@ impl GatewayDataState {
         Ok(Some(snapshot))
     }
 
+    pub(crate) async fn resolve_user_effective_list_policies(
+        &self,
+        user: &StoredUserAuthRecord,
+    ) -> Result<GatewayUserEffectiveListPolicies, DataLayerError> {
+        if user.role.eq_ignore_ascii_case("admin") {
+            return Ok(GatewayUserEffectiveListPolicies::default());
+        }
+
+        let groups = if self.user_reader.is_some() {
+            self.effective_user_groups_for_user(&user.id).await?
+        } else {
+            Vec::new()
+        };
+        Ok(GatewayUserEffectiveListPolicies {
+            allowed_providers: resolve_effective_list_policy(
+                user.allowed_providers.clone(),
+                &user.allowed_providers_mode,
+                &groups,
+                |group| {
+                    (
+                        &group.allowed_providers_mode,
+                        group.allowed_providers.clone(),
+                    )
+                },
+            ),
+            allowed_api_formats: resolve_effective_list_policy(
+                user.allowed_api_formats.clone(),
+                &user.allowed_api_formats_mode,
+                &groups,
+                |group| {
+                    (
+                        &group.allowed_api_formats_mode,
+                        group.allowed_api_formats.clone(),
+                    )
+                },
+            ),
+            allowed_models: resolve_effective_list_policy(
+                user.allowed_models.clone(),
+                &user.allowed_models_mode,
+                &groups,
+                |group| (&group.allowed_models_mode, group.allowed_models.clone()),
+            ),
+        })
+    }
+
+    async fn effective_user_groups_for_user(
+        &self,
+        user_id: &str,
+    ) -> Result<Vec<aether_data::repository::users::StoredUserGroup>, DataLayerError> {
+        let Some(repository) = self.user_reader.as_ref() else {
+            return Ok(Vec::new());
+        };
+        let mut groups = repository.list_user_groups_for_user(user_id).await?;
+        let dynamic_group_ids = self.active_membership_group_ids_for_user(user_id).await?;
+        if !dynamic_group_ids.is_empty() {
+            groups.extend(
+                repository
+                    .list_user_groups_by_ids(&dynamic_group_ids)
+                    .await?,
+            );
+            let mut deduped = std::collections::BTreeMap::new();
+            for group in groups {
+                deduped.insert(group.id.clone(), group);
+            }
+            groups = deduped.into_values().collect();
+        }
+        groups.sort_by(|left, right| {
+            left.name
+                .cmp(&right.name)
+                .then_with(|| left.id.cmp(&right.id))
+        });
+        Ok(groups)
+    }
+
     async fn active_membership_group_ids_for_user(
         &self,
         user_id: &str,

apps/aether-gateway/src/handlers/admin/provider/oauth/quota/codex/mod.rs

@@ -8,8 +8,7 @@ use self::invalid::{
     codex_structured_invalid_reason,
 };
 use self::parse::{
-    build_codex_quota_exhausted_fallback_metadata, parse_codex_usage_headers,
+    parse_codex_backend_me_response, parse_codex_usage_headers, parse_codex_wham_usage_response,
-    parse_codex_wham_usage_response,
 };
 use self::plan::{build_codex_quota_request_spec, execute_codex_quota_plan};
 use super::shared::{
@@ -111,7 +110,7 @@ pub(crate) async fn refresh_codex_provider_quota_locally(
                     "key_id": key.id,
                     "key_name": key.name,
                     "status": "error",
-                    "message": format!("wham/usage 请求执行失败: {detail}"),
+                    "message": format!("backend-api/me 请求执行失败: {detail}"),
                     "status_code": 502,
                 }));
                 continue;
@@ -138,7 +137,9 @@ pub(crate) async fn refresh_codex_provider_quota_locally(
                 .as_ref()
                 .and_then(|body| body.json_body.as_ref())
             {
-                if let Some(parsed) = parse_codex_wham_usage_response(body_json, now_unix_secs) {
+                if let Some(parsed) = parse_codex_backend_me_response(body_json, now_unix_secs)
+                    .or_else(|| parse_codex_wham_usage_response(body_json, now_unix_secs))
+                {
                     metadata_update = Some(json!({
                         "codex": merge_codex_quota_metadata(header_metadata.as_ref(), &parsed)
                     }));
@@ -151,21 +152,21 @@ pub(crate) async fn refresh_codex_provider_quota_locally(
                     status = "success".to_string();
                 } else {
                     status = "no_metadata".to_string();
-                    message = Some("响应中未包含限额信息".to_string());
+                    message = Some("backend-api/me 响应中未包含账号信息".to_string());
                 }
             } else {
-                message = Some("无法解析 wham/usage API 响应".to_string());
+                message = Some("无法解析 backend-api/me API 响应".to_string());
             }
         } else {
             let err_msg = extract_execution_error_message(&result);
             message = Some(match err_msg.as_deref() {
                 Some(detail) if !detail.is_empty() => {
                     format!(
-                        "wham/usage API 返回状态码 {}: {}",
+                        "backend-api/me API 返回状态码 {}: {}",
                         result.status_code, detail
                     )
                 }
-                _ => format!("wham/usage API 返回状态码 {}", result.status_code),
+                _ => format!("backend-api/me API 返回状态码 {}", result.status_code),
             });
 
             match result.status_code {
@@ -222,26 +223,14 @@ pub(crate) async fn refresh_codex_provider_quota_locally(
                         oauth_invalid_reason = reason;
                         status = "workspace_deactivated".to_string();
                     } else {
-                        let plan_type = transport
+                        let (at, reason) = codex_build_invalid_state(
-                            .key
+                            &key,
-                            .decrypted_auth_config
+                            codex_structured_invalid_reason(402, err_msg.as_deref()),
-                            .as_deref()
-                            .and_then(|raw| serde_json::from_str::<serde_json::Value>(raw).ok())
-                            .and_then(|value| {
-                                value
-                                    .get("plan_type")
-                                    .and_then(serde_json::Value::as_str)
-                                    .map(ToOwned::to_owned)
-                            });
-                        metadata_update = Some(json!({
-                            "codex": build_codex_quota_exhausted_fallback_metadata(
-                                plan_type.as_deref(),
                             now_unix_secs,
-                            )
+                        );
-                        }));
+                        oauth_invalid_at_unix_secs = at;
-                        (oauth_invalid_at_unix_secs, oauth_invalid_reason) =
+                        oauth_invalid_reason = reason;
-                            quota_refresh_success_invalid_state(&key);
+                        status = "payment_required".to_string();
-                        status = "quota_exhausted".to_string();
                     }
                 }
                 403 => {

apps/aether-gateway/src/handlers/admin/provider/oauth/quota/codex/parse.rs

@@ -22,6 +22,13 @@ pub(super) fn parse_codex_wham_usage_response(
     admin_provider_quota_pure::parse_codex_wham_usage_response(value, updated_at_unix_secs)
 }
 
+pub(super) fn parse_codex_backend_me_response(
+    value: &serde_json::Value,
+    updated_at_unix_secs: u64,
+) -> Option<serde_json::Value> {
+    admin_provider_quota_pure::parse_codex_backend_me_response(value, updated_at_unix_secs)
+}
+
 pub(super) fn parse_codex_usage_headers(
     headers: &BTreeMap<String, String>,
     updated_at_unix_secs: u64,

apps/aether-gateway/src/handlers/admin/provider/shared/payloads.rs

@@ -226,7 +226,7 @@ pub(crate) struct AdminProviderUpdateRequest {
 
 pub(crate) type AdminProviderUpdatePatch = AdminTypedObjectPatch<AdminProviderUpdateRequest>;
 
-pub(crate) const CODEX_WHAM_USAGE_URL: &str = "https://chatgpt.com/backend-api/wham/usage";
+pub(crate) const CODEX_WHAM_USAGE_URL: &str = "https://chatgpt.com/backend-api/me";
 pub(crate) const KIRO_USAGE_LIMITS_PATH: &str = "/getUsageLimits";
 pub(crate) const KIRO_USAGE_SDK_VERSION: &str = "1.0.0";
 pub(crate) const ANTIGRAVITY_FETCH_AVAILABLE_MODELS_PATH: &str = "/v1internal:fetchAvailableModels";

apps/aether-gateway/src/handlers/public/catalog_helpers.rs

@@ -50,6 +50,28 @@ pub(crate) fn normalize_admin_base_url(base_url: &str) -> Result<String, String>
     Ok(normalized.to_string())
 }
 
+pub(crate) fn sanitize_public_model_config_for_user(
+    config: Option<serde_json::Value>,
+) -> Option<serde_json::Value> {
+    let Some(mut config) = config else {
+        return None;
+    };
+    if let Some(object) = config.as_object_mut() {
+        for key in [
+            "model_mappings",
+            "model_mapping",
+            "global_model_mappings",
+            "provider_model_mappings",
+            "provider_model_aliases",
+            "mapping_preview",
+            "model_mapping_preview",
+        ] {
+            object.remove(key);
+        }
+    }
+    Some(config)
+}
+
 pub(crate) fn admin_requested_force_stream(value: &serde_json::Value) -> bool {
     match value {
         serde_json::Value::Bool(value) => *value,
@@ -165,21 +187,12 @@ pub(crate) async fn build_public_providers_payload(
         .into_iter()
         .map(|provider| {
             let provider_id = provider.id.clone();
-            let description = provider
-                .config
-                .as_ref()
-                .and_then(|value| value.get("description"))
-                .and_then(serde_json::Value::as_str)
-                .map(ToOwned::to_owned);
             let model_count = models_by_provider
                 .get(&provider_id)
                 .map(BTreeSet::len)
                 .unwrap_or(0);
             json!({
                 "id": provider_id.clone(),
-                "name": provider.name,
-                "description": description,
-                "website": provider.website,
                 "is_active": provider.is_active,
                 "provider_priority": provider.provider_priority,
                 "models_count": model_count,
@@ -196,8 +209,6 @@ pub(crate) async fn build_public_providers_payload(
 fn serialize_public_catalog_model(model: StoredPublicCatalogModel) -> serde_json::Value {
     json!({
         "id": model.id,
-        "provider_id": model.provider_id,
-        "provider_name": model.provider_name,
         "name": model.name,
         "display_name": model.display_name,
         "description": model.description,

apps/aether-gateway/src/handlers/public/mod.rs

@@ -11,7 +11,7 @@ pub(crate) use self::catalog_helpers::{
     build_public_catalog_models_payload, build_public_catalog_search_models_payload,
     build_public_health_timeline, build_public_providers_payload, normalize_admin_base_url,
     provider_key_api_formats, request_candidate_event_unix_ms, request_candidate_status_label,
-    ApiFormatHealthMonitorOptions,
+    sanitize_public_model_config_for_user, ApiFormatHealthMonitorOptions,
 };
 pub(crate) use self::system_modules_helpers::{
     build_admin_keys_grouped_by_format_payload, build_public_auth_modules_status_payload,

apps/aether-gateway/src/handlers/public/support.rs

@@ -2,8 +2,8 @@ use super::{
     build_api_format_health_monitor_payload, build_public_auth_modules_status_payload,
     build_public_catalog_models_payload, build_public_catalog_search_models_payload,
     build_public_providers_payload, capability_detail_by_name, ldap_module_config_is_valid,
-    serialize_public_capability, supported_capability_names, ApiFormatHealthMonitorOptions,
+    sanitize_public_model_config_for_user, serialize_public_capability, supported_capability_names,
-    PUBLIC_CAPABILITY_DEFINITIONS,
+    ApiFormatHealthMonitorOptions, PUBLIC_CAPABILITY_DEFINITIONS,
 };
 use crate::control::GatewayPublicRequestContext;
 use crate::handlers::shared::{
@@ -232,10 +232,17 @@ pub(crate) async fn maybe_build_local_public_support_response(
                 .flatten()
                 .and_then(|value| value.as_str().map(ToOwned::to_owned))
                 .unwrap_or_else(|| "AI Gateway".to_string());
+            let show_github_link = state
+                .read_system_config_json_value("show_github_link")
+                .await
+                .ok()
+                .flatten();
+            let show_github_link = system_config_bool(show_github_link.as_ref(), true);
             return Some(
                 Json(json!({
                     "site_name": site_name,
                     "site_subtitle": site_subtitle,
+                    "show_github_link": show_github_link,
                 }))
                 .into_response(),
             );
@@ -374,7 +381,7 @@ pub(crate) async fn maybe_build_local_public_support_response(
                         "default_price_per_request": model.default_price_per_request,
                         "default_tiered_pricing": model.default_tiered_pricing,
                         "supported_capabilities": model.supported_capabilities,
-                        "config": model.config,
+                        "config": sanitize_public_model_config_for_user(model.config),
                         "usage_count": model.usage_count,
                     })
                 })
@@ -576,15 +583,11 @@ pub(crate) async fn maybe_build_local_public_support_response(
                 .await
                 .ok()
                 .unwrap_or_default();
-            let current_provider = providers
-                .first()
-                .map(|provider| provider.name.clone())
-                .unwrap_or_else(|| "None".to_string());
             return Some(
                 Json(json!({
                     "message": "AI Proxy with Modular Architecture v4.0.0",
                     "status": "running",
-                    "current_provider": current_provider,
+                    "current_provider": serde_json::Value::Null,
                     "available_providers": providers.len(),
                     "config": {},
                     "endpoints": {
@@ -647,10 +650,8 @@ pub(crate) async fn maybe_build_local_public_support_response(
                         .into_iter()
                         .map(|provider| {
                             let provider_id = provider.id.clone();
-                            let provider_name = provider.name.clone();
                             let mut payload = json!({
                                 "id": provider_id.clone(),
-                                "name": provider_name,
                                 "is_active": provider.is_active,
                                 "provider_priority": provider.provider_priority,
                             });
@@ -661,7 +662,6 @@ pub(crate) async fn maybe_build_local_public_support_response(
                                         .filter(|endpoint| endpoint.provider_id == provider_id)
                                         .map(|endpoint| json!({
                                             "id": endpoint.id,
-                                            "base_url": endpoint.base_url,
                                             "api_format": endpoint.api_format,
                                             "is_active": endpoint.is_active,
                                         }))
@@ -709,19 +709,19 @@ pub(crate) async fn maybe_build_local_public_support_response(
             };
             let provider = match provider {
                 Some(provider) => provider,
-                None => state
+                None => {
-                    .list_provider_catalog_providers(false)
+                    return Some(
-                    .await
+                        (
-                    .ok()
+                            http::StatusCode::NOT_FOUND,
-                    .unwrap_or_default()
+                            Json(json!({ "detail": "Provider not found" })),
-                    .into_iter()
+                        )
-                    .find(|provider| provider.name == provider_identifier)?,
+                            .into_response(),
+                    );
+                }
             };
             let provider_id = provider.id.clone();
-            let provider_name = provider.name.clone();
             let mut payload = json!({
                 "id": provider_id.clone(),
-                "name": provider_name,
                 "is_active": provider.is_active,
                 "provider_priority": provider.provider_priority,
             });
@@ -739,7 +739,6 @@ pub(crate) async fn maybe_build_local_public_support_response(
                         .map(|endpoint| {
                             json!({
                                 "id": endpoint.id,
-                                "base_url": endpoint.base_url,
                                 "api_format": endpoint.api_format,
                                 "is_active": endpoint.is_active,
                             })

apps/aether-gateway/src/handlers/public/support/auth.rs

@@ -18,6 +18,10 @@ pub(super) use serde_json::json;
 mod auth_helpers;
 pub(crate) use auth_helpers::*;
 
+#[path = "auth_turnstile.rs"]
+mod auth_turnstile;
+use auth_turnstile::*;
+
 #[path = "auth_email.rs"]
 mod auth_email;
 use auth_email::*;

apps/aether-gateway/src/handlers/public/support/auth_helpers.rs

@@ -1,7 +1,7 @@
 use super::{
-    http, json, ldap_module_config_is_valid, module_available_from_env, system_config_bool,
+    auth_turnstile_public_settings, http, json, ldap_module_config_is_valid,
-    system_config_string, AppState, Body, GatewayError, GatewayPublicRequestContext, IntoResponse,
+    module_available_from_env, system_config_bool, system_config_string, AppState, Body,
-    Json, Response,
+    GatewayError, GatewayPublicRequestContext, IntoResponse, Json, Response,
 };
 
 pub(crate) async fn build_auth_registration_settings_payload(
@@ -40,12 +40,17 @@ pub(crate) async fn build_auth_registration_settings_payload(
         Some(value) if matches!(value.as_str(), "weak" | "medium" | "strong") => value,
         _ => "weak".to_string(),
     };
+    let turnstile_settings = auth_turnstile_public_settings(state)
+        .await
+        .map_err(|err| GatewayError::Internal(err.detail))?;
 
     Ok(json!({
         "enable_registration": enable_registration,
         "require_email_verification": require_email_verification,
         "email_configured": email_configured,
         "password_policy_level": password_policy_level,
+        "turnstile_enabled": turnstile_settings.enabled,
+        "turnstile_site_key": turnstile_settings.site_key,
     }))
 }
 

apps/aether-gateway/src/handlers/public/support/auth_registration.rs

@@ -5,7 +5,8 @@ use super::{
     clear_auth_email_pending_code, clear_auth_email_verification, generate_auth_verification_code,
     http, json, mark_auth_email_verified, read_auth_email_verification_code, read_auth_smtp_config,
     send_auth_email, store_auth_email_verification_code, system_config_bool, system_config_f64,
-    system_config_string, system_config_string_list, AppState, Body, GatewayError, Regex, Response,
+    system_config_string, system_config_string_list, verify_auth_turnstile_token, AppState, Body,
+    GatewayError, Regex, Response,
 };
 use serde::Deserialize;
 
@@ -16,11 +17,13 @@ struct AuthRegisterRequest {
     email: Option<String>,
     username: String,
     password: String,
+    turnstile_token: Option<String>,
 }
 
 #[derive(Debug, Deserialize)]
 struct AuthEmailRequest {
     email: String,
+    turnstile_token: Option<String>,
 }
 
 #[derive(Debug, Deserialize)]
@@ -195,20 +198,6 @@ pub(super) async fn handle_auth_send_verification_code(
         return build_auth_error_response(http::StatusCode::BAD_REQUEST, "邮箱格式无效", false);
     };
 
-    if state
-        .find_user_auth_by_identifier(&email)
-        .await
-        .ok()
-        .flatten()
-        .is_some()
-    {
-        return build_auth_error_response(
-            http::StatusCode::BAD_REQUEST,
-            "该邮箱已被注册，请直接登录或使用其他邮箱",
-            false,
-        );
-    }
-
     match validate_auth_email_suffix(state, &email).await {
         Ok(Ok(())) => {}
         Ok(Err(detail)) => {
@@ -223,6 +212,26 @@ pub(super) async fn handle_auth_send_verification_code(
         }
     }
 
+    if let Err(err) =
+        verify_auth_turnstile_token(state, payload.turnstile_token.as_deref(), None).await
+    {
+        return build_auth_error_response(err.status, err.detail, false);
+    }
+
+    if state
+        .find_user_auth_by_identifier(&email)
+        .await
+        .ok()
+        .flatten()
+        .is_some()
+    {
+        return build_auth_error_response(
+            http::StatusCode::BAD_REQUEST,
+            "该邮箱已被注册，请直接登录或使用其他邮箱",
+            false,
+        );
+    }
+
     let smtp_config = match read_auth_smtp_config(state).await {
         Ok(Some(value)) => value,
         Ok(None) => {
@@ -421,6 +430,10 @@ pub(super) async fn handle_auth_register(
                 );
             }
         }
+    } else if let Err(err) =
+        verify_auth_turnstile_token(state, payload.turnstile_token.as_deref(), None).await
+    {
+        return build_auth_error_response(err.status, err.detail, false);
     }
     if let Some(email) = email.as_deref() {
         match validate_auth_email_suffix(state, email).await {

apps/aether-gateway/src/handlers/public/support/auth_turnstile.rs

@@ -0,0 +1,209 @@
+use super::{
+    decrypt_catalog_secret_with_fallbacks, http, system_config_bool, system_config_string,
+    system_config_string_list, AppState,
+};
+use serde::Deserialize;
+use std::time::Duration;
+
+const TURNSTILE_SITEVERIFY_URL: &str = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
+
+#[derive(Debug, Clone)]
+pub(super) struct AuthTurnstilePublicSettings {
+    pub(super) enabled: bool,
+    pub(super) site_key: Option<String>,
+}
+
+#[derive(Debug)]
+pub(super) struct AuthTurnstileError {
+    pub(super) status: http::StatusCode,
+    pub(super) detail: String,
+}
+
+#[derive(Debug)]
+struct AuthTurnstileConfig {
+    enabled: bool,
+    site_key: Option<String>,
+    secret_key: Option<String>,
+    siteverify_url: String,
+    allowed_hostnames: Vec<String>,
+}
+
+#[derive(Debug, Deserialize)]
+struct TurnstileSiteverifyResponse {
+    success: bool,
+    hostname: Option<String>,
+    #[serde(default, rename = "error-codes")]
+    error_codes: Vec<String>,
+}
+
+fn turnstile_error(status: http::StatusCode, detail: impl Into<String>) -> AuthTurnstileError {
+    AuthTurnstileError {
+        status,
+        detail: detail.into(),
+    }
+}
+
+fn turnstile_config_error(detail: impl Into<String>) -> AuthTurnstileError {
+    turnstile_error(http::StatusCode::INTERNAL_SERVER_ERROR, detail)
+}
+
+async fn read_auth_turnstile_config(
+    state: &AppState,
+) -> Result<AuthTurnstileConfig, AuthTurnstileError> {
+    let enabled = state
+        .read_system_config_json_value("turnstile_enabled")
+        .await
+        .map_err(|err| {
+            turnstile_config_error(format!("auth turnstile settings lookup failed: {err:?}"))
+        })?;
+    let site_key = state
+        .read_system_config_json_value("turnstile_site_key")
+        .await
+        .map_err(|err| {
+            turnstile_config_error(format!("auth turnstile settings lookup failed: {err:?}"))
+        })?;
+    let secret_key = state
+        .read_system_config_json_value("turnstile_secret_key")
+        .await
+        .map_err(|err| {
+            turnstile_config_error(format!("auth turnstile settings lookup failed: {err:?}"))
+        })?;
+    let siteverify_url = state
+        .read_system_config_json_value("turnstile_siteverify_url")
+        .await
+        .map_err(|err| {
+            turnstile_config_error(format!("auth turnstile settings lookup failed: {err:?}"))
+        })?;
+    let allowed_hostnames = state
+        .read_system_config_json_value("turnstile_allowed_hostnames")
+        .await
+        .map_err(|err| {
+            turnstile_config_error(format!("auth turnstile settings lookup failed: {err:?}"))
+        })?;
+
+    let secret_key = system_config_string(secret_key.as_ref()).map(|value| {
+        decrypt_catalog_secret_with_fallbacks(state.encryption_key(), &value).unwrap_or(value)
+    });
+
+    Ok(AuthTurnstileConfig {
+        enabled: system_config_bool(enabled.as_ref(), false),
+        site_key: system_config_string(site_key.as_ref()),
+        secret_key,
+        siteverify_url: system_config_string(siteverify_url.as_ref())
+            .unwrap_or_else(|| TURNSTILE_SITEVERIFY_URL.to_string()),
+        allowed_hostnames: system_config_string_list(allowed_hostnames.as_ref()),
+    })
+}
+
+pub(super) async fn auth_turnstile_public_settings(
+    state: &AppState,
+) -> Result<AuthTurnstilePublicSettings, AuthTurnstileError> {
+    let config = read_auth_turnstile_config(state).await?;
+    let enabled = config.enabled && config.site_key.is_some();
+    Ok(AuthTurnstilePublicSettings {
+        enabled,
+        site_key: enabled.then_some(config.site_key).flatten(),
+    })
+}
+
+fn turnstile_service_error(error_codes: &[String]) -> bool {
+    error_codes.iter().any(|code| {
+        matches!(
+            code.trim(),
+            "missing-input-secret" | "invalid-input-secret" | "internal-error"
+        )
+    })
+}
+
+fn turnstile_hostname_allowed(hostname: Option<&str>, allowed_hostnames: &[String]) -> bool {
+    if allowed_hostnames.is_empty() {
+        return true;
+    }
+    let Some(hostname) = hostname.map(str::trim).filter(|value| !value.is_empty()) else {
+        return false;
+    };
+    let hostname = hostname.to_ascii_lowercase();
+    allowed_hostnames.iter().any(|allowed| allowed == &hostname)
+}
+
+pub(super) async fn verify_auth_turnstile_token(
+    state: &AppState,
+    token: Option<&str>,
+    remote_ip: Option<&str>,
+) -> Result<(), AuthTurnstileError> {
+    let config = read_auth_turnstile_config(state).await?;
+    if !config.enabled || config.site_key.is_none() {
+        return Ok(());
+    }
+    let token = token
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+        .ok_or_else(|| turnstile_error(http::StatusCode::BAD_REQUEST, "请先完成人机验证"))?;
+    let secret_key = config.secret_key.as_deref().ok_or_else(|| {
+        turnstile_error(http::StatusCode::SERVICE_UNAVAILABLE, "人机验证服务未配置")
+    })?;
+
+    let client = reqwest::Client::builder()
+        .timeout(Duration::from_secs(8))
+        .build()
+        .map_err(|err| {
+            turnstile_error(
+                http::StatusCode::SERVICE_UNAVAILABLE,
+                format!("人机验证服务暂不可用: {err}"),
+            )
+        })?;
+    let mut form = vec![
+        ("secret", secret_key.to_string()),
+        ("response", token.to_string()),
+    ];
+    if let Some(remote_ip) = remote_ip.map(str::trim).filter(|value| !value.is_empty()) {
+        form.push(("remoteip", remote_ip.to_string()));
+    }
+
+    let response = client
+        .post(config.siteverify_url)
+        .form(&form)
+        .send()
+        .await
+        .map_err(|_| {
+            turnstile_error(
+                http::StatusCode::SERVICE_UNAVAILABLE,
+                "人机验证服务暂不可用",
+            )
+        })?;
+    if !response.status().is_success() {
+        return Err(turnstile_error(
+            http::StatusCode::SERVICE_UNAVAILABLE,
+            "人机验证服务暂不可用",
+        ));
+    }
+
+    let payload = response
+        .json::<TurnstileSiteverifyResponse>()
+        .await
+        .map_err(|_| {
+            turnstile_error(
+                http::StatusCode::SERVICE_UNAVAILABLE,
+                "人机验证服务暂不可用",
+            )
+        })?;
+    if payload.success {
+        if turnstile_hostname_allowed(payload.hostname.as_deref(), &config.allowed_hostnames) {
+            return Ok(());
+        }
+        return Err(turnstile_error(
+            http::StatusCode::BAD_REQUEST,
+            "人机验证失败，请重试",
+        ));
+    }
+    if turnstile_service_error(&payload.error_codes) {
+        return Err(turnstile_error(
+            http::StatusCode::SERVICE_UNAVAILABLE,
+            "人机验证服务暂不可用",
+        ));
+    }
+    Err(turnstile_error(
+        http::StatusCode::BAD_REQUEST,
+        "人机验证失败，请重试",
+    ))
+}

apps/aether-gateway/src/handlers/public/support/dashboard_filters.rs

@@ -1,3 +1,4 @@
+use super::super::support_wallet::build_wallet_balance_payload_for_user;
 use super::{
     build_auth_error_response, query_param_value, resolve_authenticated_local_user, AppState,
     GatewayError, GatewayPublicRequestContext,
@@ -180,6 +181,35 @@ fn dashboard_format_usd(value: f64) -> String {
     format!("${:.2}", dashboard_round_f64(value, 2))
 }
 
+fn dashboard_json_f64(value: Option<&serde_json::Value>) -> f64 {
+    value.and_then(serde_json::Value::as_f64).unwrap_or(0.0)
+}
+
+fn dashboard_wallet_card_value_and_subvalue(
+    wallet_payload: &serde_json::Value,
+) -> (String, String) {
+    let unlimited = wallet_payload
+        .get("unlimited")
+        .and_then(serde_json::Value::as_bool)
+        .unwrap_or(false);
+    if unlimited {
+        return ("无限额度".to_string(), "无限额度".to_string());
+    }
+
+    let package_balance = dashboard_json_f64(wallet_payload.get("package_balance")).max(0.0);
+    let wallet_balance = dashboard_json_f64(wallet_payload.get("wallet_balance")).max(0.0);
+    let total_available =
+        dashboard_json_f64(wallet_payload.get("total_available_balance")).max(0.0);
+    (
+        dashboard_format_usd(total_available),
+        format!(
+            "套餐额度 {} · 钱包余额 {}",
+            dashboard_format_usd(package_balance),
+            dashboard_format_usd(wallet_balance)
+        ),
+    )
+}
+
 fn dashboard_format_percentage(value: f64) -> String {
     format!("{:.1}%", dashboard_round_f64(value, 1))
 }
@@ -1050,26 +1080,10 @@ pub(super) async fn handle_dashboard_stats_get(
     } else {
         None
     };
-    let wallet_value = wallet
+    let wallet_payload =
-        .as_ref()
+        build_wallet_balance_payload_for_user(state, &auth.user.id, wallet.as_ref()).await;
-        .map(|wallet| {
+    let (wallet_value, wallet_sub_value) =
-            if wallet.limit_mode.eq_ignore_ascii_case("unlimited") {
+        dashboard_wallet_card_value_and_subvalue(&wallet_payload);
-                "无限制".to_string()
-            } else {
-                dashboard_format_usd(wallet.balance)
-            }
-        })
-        .unwrap_or_else(|| dashboard_format_usd(0.0));
-    let wallet_sub_value = wallet
-        .as_ref()
-        .map(|wallet| {
-            if wallet.limit_mode.eq_ignore_ascii_case("unlimited") {
-                "无限额度".to_string()
-            } else {
-                format!("赠款 {}", dashboard_format_usd(wallet.gift_balance))
-            }
-        })
-        .unwrap_or_else(|| "暂无钱包".to_string());
     let payload = json!({
         "stats": [
             {
@@ -1305,6 +1319,19 @@ pub(super) async fn handle_dashboard_provider_status_get(
     request_context: &GatewayPublicRequestContext,
     headers: &http::HeaderMap,
 ) -> Response<Body> {
+    let auth = match resolve_authenticated_local_user(state, request_context, headers).await {
+        Ok(value) => value,
+        Err(response) => return response,
+    };
+
+    if !dashboard_role_is_admin(&auth.user.role) {
+        return build_auth_error_response(
+            http::StatusCode::FORBIDDEN,
+            "仅管理员可查看供应商状态",
+            false,
+        );
+    }
+
     if !state.has_usage_data_reader() {
         return dashboard_backend_unavailable_response("Usage data backend unavailable");
     }
@@ -1312,16 +1339,7 @@ pub(super) async fn handle_dashboard_provider_status_get(
         return dashboard_backend_unavailable_response("Provider catalog backend unavailable");
     }
 
-    let auth = match resolve_authenticated_local_user(state, request_context, headers).await {
+    let cache_identity = "admin";
-        Ok(value) => value,
-        Err(response) => return response,
-    };
-
-    let cache_identity = if dashboard_role_is_admin(&auth.user.role) {
-        "admin"
-    } else {
-        auth.user.id.as_str()
-    };
     let cache_key = format!("provider:{cache_identity}");
     let cache_ttl = std::time::Duration::from_secs(20);
 
@@ -1398,11 +1416,7 @@ pub(super) async fn handle_dashboard_provider_status_get(
                     .cmp(right["name"].as_str().unwrap_or_default())
             })
     });
-    let limit = if dashboard_role_is_admin(&auth.user.role) {
+    let limit = 10;
-        10
-    } else {
-        5
-    };
     if entries.len() > limit {
         entries.truncate(limit);
     }

apps/aether-gateway/src/handlers/public/support/models/responses.rs

@@ -7,6 +7,8 @@ use axum::{
 };
 use serde_json::json;
 
+const PUBLIC_MODELS_OWNER: &str = "aether";
+
 pub(crate) fn build_models_auth_error_response(api_format: &str) -> Response<Body> {
     match api_format {
         "claude:messages" => (
@@ -109,7 +111,7 @@ pub(super) fn build_openai_models_list_response(
                 "id": row.global_model_name,
                 "object": "model",
                 "created": 0,
-                "owned_by": row.provider_name,
+                "owned_by": PUBLIC_MODELS_OWNER,
             })
         }).collect::<Vec<_>>(),
     }))
@@ -123,7 +125,7 @@ pub(super) fn build_openai_model_detail_response(
         "id": row.global_model_name,
         "object": "model",
         "created": 0,
-        "owned_by": row.provider_name,
+        "owned_by": PUBLIC_MODELS_OWNER,
     }))
     .into_response()
 }

apps/aether-gateway/src/handlers/public/support/test_connection/route.rs

@@ -338,7 +338,7 @@ pub(super) async fn maybe_build_local_test_connection_route_response(
     Some(
         Json(json!({
             "status": "success",
-            "provider": provider.name,
+            "provider_id": provider.id,
             "endpoint_id": endpoint.id,
             "api_format": format_value,
             "timestamp": timestamp,

apps/aether-gateway/src/handlers/public/support/test_connection/shared.rs

@@ -8,12 +8,13 @@ pub(super) fn select_test_connection_provider(
         .map(str::trim)
         .filter(|value| !value.is_empty());
     if let Some(provider_query) = provider_query {
-        if let Some(provider) = providers.iter().find(|provider| {
+        if let Some(provider) = providers
-            provider.id.eq_ignore_ascii_case(provider_query)
+            .iter()
-                || provider.name.eq_ignore_ascii_case(provider_query)
+            .find(|provider| provider.id.eq_ignore_ascii_case(provider_query))
-        }) {
+        {
             return Some(provider.clone());
         }
+        return None;
     }
     providers.into_iter().next()
 }

apps/aether-gateway/src/handlers/public/support/user_me.rs

@@ -2,7 +2,7 @@ use super::{
     auth_password_policy_level, build_auth_error_response, build_auth_wallet_summary_payload,
     decrypt_catalog_secret_with_fallbacks, encrypt_catalog_secret_with_fallbacks, handle_auth_me,
     handle_users_me_api_key_install_session_create, query_param_optional_bool, query_param_value,
-    resolve_authenticated_local_user, unix_secs_to_rfc3339,
+    resolve_authenticated_local_user, sanitize_public_model_config_for_user, unix_secs_to_rfc3339,
     users_me_api_key_install_sessions_path_matches, validate_auth_register_password, AppState,
     AuthenticatedLocalUserContext, GatewayPublicRequestContext, PUBLIC_CAPABILITY_DEFINITIONS,
 };

apps/aether-gateway/src/handlers/public/support/user_me_catalog.rs

@@ -14,15 +14,23 @@ use serde_json::json;
 
 use super::{
     build_admin_endpoint_health_status_payload, build_auth_error_response, query_param_value,
-    resolve_authenticated_local_user, AppState, GatewayPublicRequestContext,
+    resolve_authenticated_local_user, sanitize_public_model_config_for_user, AppState,
-    USERS_ME_AVAILABLE_MODELS_FETCH_LIMIT,
+    GatewayPublicRequestContext, USERS_ME_AVAILABLE_MODELS_FETCH_LIMIT,
 };
 
 const USERS_ME_MODEL_CATALOG_UNAVAILABLE_DETAIL: &str = "用户模型目录暂不可用";
 const USERS_ME_PROVIDER_CATALOG_UNAVAILABLE_DETAIL: &str = "用户提供商目录暂不可用";
 const USERS_ME_ENDPOINT_STATUS_UNAVAILABLE_DETAIL: &str = "用户端点健康数据暂不可用";
 
-fn build_users_me_available_model_payload(model: StoredPublicGlobalModel) -> serde_json::Value {
+fn build_users_me_available_model_payload(
+    model: StoredPublicGlobalModel,
+    hide_mapping_config: bool,
+) -> serde_json::Value {
+    let config = if hide_mapping_config {
+        sanitize_public_model_config_for_user(model.config)
+    } else {
+        model.config
+    };
     json!({
         "id": model.id,
         "name": model.name,
@@ -31,7 +39,7 @@ fn build_users_me_available_model_payload(model: StoredPublicGlobalModel) -> ser
         "default_price_per_request": model.default_price_per_request,
         "default_tiered_pricing": model.default_tiered_pricing,
         "supported_capabilities": model.supported_capabilities,
-        "config": model.config,
+        "config": config,
         "usage_count": model.usage_count,
     })
 }
@@ -49,35 +57,27 @@ fn parse_users_me_available_models_query(query: Option<&str>) -> (usize, usize,
 }
 
 fn users_me_allowed_provider_names(
-    user: &aether_data::repository::users::StoredUserAuthRecord,
+    allowed_providers: Option<&[String]>,
 ) -> Option<BTreeSet<String>> {
-    if user.role.eq_ignore_ascii_case("admin") {
+    allowed_providers.map(|providers| {
-        return None;
-    }
-
-    user.allowed_providers
-        .as_ref()
-        .map(|providers| {
         providers
             .iter()
             .map(|value| value.trim().to_ascii_lowercase())
             .filter(|value| !value.is_empty())
             .collect::<BTreeSet<_>>()
     })
-        .filter(|providers| !providers.is_empty())
 }
 
 async fn resolve_users_me_allowed_global_model_ids(
     state: &AppState,
-    user: &aether_data::repository::users::StoredUserAuthRecord,
+    allowed_providers: Option<&[String]>,
 ) -> Result<Option<BTreeSet<String>>, Response<Body>> {
-    let Some(allowed_providers) = user
+    let Some(allowed_providers) = allowed_providers else {
-        .allowed_providers
-        .as_ref()
-        .filter(|providers| !providers.is_empty())
-    else {
         return Ok(None);
     };
+    if allowed_providers.is_empty() {
+        return Ok(Some(BTreeSet::new()));
+    }
 
     if !state.has_provider_catalog_data_reader() {
         return Err(build_auth_error_response(
@@ -155,10 +155,35 @@ pub(super) async fn handle_users_me_available_models(
     let (skip, limit, search) =
         parse_users_me_available_models_query(request_context.request_query_string.as_deref());
 
+    let effective_policies = if auth.user.role.eq_ignore_ascii_case("admin") {
+        None
+    } else {
+        match state
+            .data
+            .resolve_user_effective_list_policies(&auth.user)
+            .await
+        {
+            Ok(value) => Some(value),
+            Err(err) => {
+                return build_auth_error_response(
+                    http::StatusCode::INTERNAL_SERVER_ERROR,
+                    format!("user policy lookup failed: {err:?}"),
+                    false,
+                )
+            }
+        }
+    };
     let provider_model_ids = if auth.user.role.eq_ignore_ascii_case("admin") {
         None
     } else {
-        match resolve_users_me_allowed_global_model_ids(state, &auth.user).await {
+        match resolve_users_me_allowed_global_model_ids(
+            state,
+            effective_policies
+                .as_ref()
+                .and_then(|policies| policies.allowed_providers.as_deref()),
+        )
+        .await
+        {
             Ok(value) => value,
             Err(response) => return response,
         }
@@ -166,9 +191,9 @@ pub(super) async fn handle_users_me_available_models(
     let allowed_models: Option<BTreeSet<String>> = if auth.user.role.eq_ignore_ascii_case("admin") {
         None
     } else {
-        auth.user
+        effective_policies
-            .allowed_models
             .as_ref()
+            .and_then(|policies| policies.allowed_models.as_ref())
             .map(|models: &Vec<String>| {
                 models
                     .iter()
@@ -176,9 +201,18 @@ pub(super) async fn handle_users_me_available_models(
                     .filter(|value: &String| !value.is_empty())
                     .collect::<BTreeSet<_>>()
             })
-            .filter(|models: &BTreeSet<String>| !models.is_empty())
     };
 
+    let hide_mapping_config = !auth.user.role.eq_ignore_ascii_case("admin");
+
+    let allowed_models: Option<BTreeSet<String>> = allowed_models.map(|models| {
+        models
+            .into_iter()
+            .map(|value| value.trim().to_ascii_lowercase())
+            .filter(|value| !value.is_empty())
+            .collect::<BTreeSet<_>>()
+    });
+
     let page = if provider_model_ids.is_none() && allowed_models.is_none() {
         match state
             .list_public_global_models(&PublicGlobalModelQuery {
@@ -247,7 +281,7 @@ pub(super) async fn handle_users_me_available_models(
         "models": page
             .items
             .into_iter()
-            .map(build_users_me_available_model_payload)
+            .map(|model| build_users_me_available_model_payload(model, hide_mapping_config))
             .collect::<Vec<_>>(),
         "total": page.total,
     }))
@@ -271,7 +305,26 @@ pub(super) async fn handle_users_me_providers_get(
         Ok(value) => value,
         Err(response) => return response,
     };
-    let allowed_provider_names = users_me_allowed_provider_names(&auth.user);
+    let expose_provider_details = auth.user.role.eq_ignore_ascii_case("admin");
+    let allowed_provider_names = if expose_provider_details {
+        None
+    } else {
+        let effective_policies = match state
+            .data
+            .resolve_user_effective_list_policies(&auth.user)
+            .await
+        {
+            Ok(value) => value,
+            Err(err) => {
+                return build_auth_error_response(
+                    http::StatusCode::INTERNAL_SERVER_ERROR,
+                    format!("user policy lookup failed: {err:?}"),
+                    false,
+                )
+            }
+        };
+        users_me_allowed_provider_names(effective_policies.allowed_providers.as_deref())
+    };
 
     let mut providers = match state.list_provider_catalog_providers(true).await {
         Ok(value) => value,
@@ -315,15 +368,18 @@ pub(super) async fn handle_users_me_providers_get(
     };
     let mut endpoints_by_provider = BTreeMap::<String, Vec<serde_json::Value>>::new();
     for endpoint in endpoints {
+        let mut endpoint_payload = json!({
+            "id": endpoint.id,
+            "api_format": endpoint.api_format,
+            "is_active": endpoint.is_active,
+        });
+        if expose_provider_details {
+            endpoint_payload["base_url"] = json!(endpoint.base_url);
+        }
         endpoints_by_provider
             .entry(endpoint.provider_id)
             .or_default()
-            .push(json!({
+            .push(endpoint_payload);
-                "id": endpoint.id,
-                "api_format": endpoint.api_format,
-                "base_url": endpoint.base_url,
-                "is_active": endpoint.is_active,
-            }));
     }
 
     let mut models_by_provider = BTreeMap::<String, Vec<serde_json::Value>>::new();
@@ -375,20 +431,23 @@ pub(super) async fn handle_users_me_providers_get(
             .into_iter()
             .map(|provider| {
                 let provider_id = provider.id.clone();
+                let mut payload = json!({
+                    "id": provider_id.clone(),
+                    "provider_priority": provider.provider_priority,
+                    "endpoints": endpoints_by_provider.remove(&provider_id).unwrap_or_default(),
+                    "models": models_by_provider.remove(&provider_id).unwrap_or_default(),
+                });
+                if expose_provider_details {
                     let description = provider
                         .config
                         .as_ref()
                         .and_then(|value| value.get("description"))
                         .and_then(serde_json::Value::as_str)
                         .map(ToOwned::to_owned);
-                json!({
+                    payload["name"] = json!(provider.name);
-                    "id": provider_id.clone(),
+                    payload["description"] = json!(description);
-                    "name": provider.name,
+                }
-                    "description": description,
+                payload
-                    "provider_priority": provider.provider_priority,
-                    "endpoints": endpoints_by_provider.remove(&provider_id).unwrap_or_default(),
-                    "models": models_by_provider.remove(&provider_id).unwrap_or_default(),
-                })
             })
             .collect::<Vec<_>>(),
     )

apps/aether-gateway/src/handlers/public/support/user_me_preferences.rs

@@ -75,12 +75,12 @@ fn validate_user_model_capability_settings(
 
 fn build_users_me_preferences_payload(
     preferences: &GatewayUserPreferenceView,
+    expose_provider_details: bool,
 ) -> serde_json::Value {
-    json!({
+    let mut payload = json!({
         "avatar_url": preferences.avatar_url,
         "bio": preferences.bio,
         "default_provider_id": preferences.default_provider_id,
-        "default_provider": preferences.default_provider_name,
         "theme": preferences.theme,
         "language": preferences.language,
         "timezone": preferences.timezone,
@@ -89,7 +89,11 @@ fn build_users_me_preferences_payload(
             "usage_alerts": preferences.usage_alerts,
             "announcements": preferences.announcement_notifications,
         },
-    })
+    });
+    if expose_provider_details {
+        payload["default_provider"] = json!(preferences.default_provider_name);
+    }
+    payload
 }
 
 fn parse_users_me_optional_string_field(
@@ -188,7 +192,11 @@ pub(super) async fn handle_users_me_preferences_get(
         }
     };
 
-    Json(build_users_me_preferences_payload(&preferences)).into_response()
+    Json(build_users_me_preferences_payload(
+        &preferences,
+        auth.user.role.eq_ignore_ascii_case("admin"),
+    ))
+    .into_response()
 }
 
 pub(super) async fn handle_users_me_preferences_put(

apps/aether-gateway/src/handlers/public/support/user_me_usage.rs

@@ -722,6 +722,7 @@ pub(super) async fn handle_users_me_usage_get(
                 );
             }
         };
+        if include_actual_cost {
             summary_by_provider = match state
                 .summarize_usage_breakdown(&UsageBreakdownSummaryQuery {
                     created_from_unix_secs,
@@ -740,6 +741,7 @@ pub(super) async fn handle_users_me_usage_get(
                     );
                 }
             };
+        }
         summary_by_api_format = match state
             .summarize_usage_breakdown(&UsageBreakdownSummaryQuery {
                 created_from_unix_secs,
@@ -936,7 +938,6 @@ pub(super) async fn handle_users_me_usage_get(
         "avg_response_time": avg_response_time,
         "billing": build_auth_wallet_summary_payload(wallet.as_ref()),
         "summary_by_model": build_users_me_usage_summary_by_model(&summary_by_model, include_actual_cost),
-        "summary_by_provider": build_users_me_usage_summary_by_provider(&summary_by_provider),
         "summary_by_api_format": build_users_me_usage_summary_by_api_format(&summary_by_api_format),
         "pagination": {
             "total": total_record_count,
@@ -948,6 +949,9 @@ pub(super) async fn handle_users_me_usage_get(
     });
     if include_actual_cost {
         payload["total_actual_cost"] = json!(total_actual_cost);
+        payload["summary_by_provider"] = json!(build_users_me_usage_summary_by_provider(
+            &summary_by_provider
+        ));
     }
     Json(payload).into_response()
 }

apps/aether-gateway/src/handlers/public/support/wallet.rs

@@ -28,6 +28,7 @@ mod redeem;
 #[path = "wallet/refunds.rs"]
 mod refunds;
 use self::flow::handle_wallet_flow;
+pub(in crate::handlers::public::support) use self::reads::build_wallet_balance_payload_for_user;
 use self::reads::{
     build_wallet_daily_usage_payload, build_wallet_payload, build_wallet_zero_today_entry,
     handle_wallet_balance, handle_wallet_today_cost, handle_wallet_transactions,

apps/aether-gateway/src/handlers/public/support/wallet/reads.rs

@@ -49,7 +49,7 @@ fn build_wallet_balance_payload(
     payload
 }
 
-async fn build_wallet_balance_payload_for_user(
+pub(in crate::handlers::public::support) async fn build_wallet_balance_payload_for_user(
     state: &AppState,
     user_id: &str,
     wallet: Option<&aether_data::repository::wallet::StoredWalletSnapshot>,

apps/aether-gateway/src/tests/control/admin/endpoints/quota.rs

@@ -29,6 +29,7 @@ async fn gateway_refreshes_admin_provider_quota_locally_for_codex_with_trusted_a
     struct SeenExecutionRuntimeRequest {
         url: String,
         authorization: String,
+        accept: String,
         provider_api_format: String,
         total_ms: Option<u64>,
     }
@@ -68,6 +69,7 @@ async fn gateway_refreshes_admin_provider_quota_locally_for_codex_with_trusted_a
                         .get("authorization")
                         .cloned()
                         .unwrap_or_default(),
+                    accept: plan.headers.get("accept").cloned().unwrap_or_default(),
                     provider_api_format: plan.provider_api_format.clone(),
                     total_ms: plan
                         .timeouts
@@ -78,41 +80,22 @@ async fn gateway_refreshes_admin_provider_quota_locally_for_codex_with_trusted_a
                     request_id: plan.request_id,
                     candidate_id: None,
                     status_code: 200,
-                    headers: BTreeMap::from([
+                    headers: BTreeMap::new(),
-                        (
-                            "x-codex-primary-reset-after-seconds".to_string(),
-                            "18000".to_string(),
-                        ),
-                        (
-                            "x-codex-primary-reset-at".to_string(),
-                            "1900000000".to_string(),
-                        ),
-                        (
-                            "x-codex-secondary-reset-after-seconds".to_string(),
-                            "604800".to_string(),
-                        ),
-                        (
-                            "x-codex-secondary-reset-at".to_string(),
-                            "1900500000".to_string(),
-                        ),
-                    ]),
                     body: Some(aether_contracts::ResponseBody {
                         json_body: Some(json!({
-                            "plan_type": "plus",
+                            "user": {
-                            "rate_limit": {
+                                "id": "user-codex-123",
-                                "primary_window": {
+                                "email": "codex@example.com",
-                                    "used_percent": 12.5,
+                                "name": "Codex User"
-                                    "window_minutes": 300
                             },
-                                "secondary_window": {
+                            "account": {
-                                    "used_percent": 55.0,
+                                "id": "acct-codex-123",
-                                    "window_minutes": 10080
+                                "name": "Personal",
-                                }
+                                "plan_type": "plus"
                             },
-                            "credits": {
+                            "plan": {
-                                "has_credits": true,
+                                "type": "Plus",
-                                "balance": 42.0,
+                                "title": "ChatGPT Plus"
-                                "unlimited": false
                             }
                         })),
                         body_bytes_b64: None,
@@ -147,7 +130,7 @@ async fn gateway_refreshes_admin_provider_quota_locally_for_codex_with_trusted_a
         )],
     ));
 
-    let (upstream_url, upstream_handle) = start_server(upstream).await;
+    let (_upstream_url, upstream_handle) = start_server(upstream).await;
     let (execution_runtime_url, execution_runtime_handle) = start_server(execution_runtime).await;
     let gateway = build_router_with_state(
         build_state_with_execution_runtime_override(execution_runtime_url.clone())
@@ -184,18 +167,22 @@ async fn gateway_refreshes_admin_provider_quota_locally_for_codex_with_trusted_a
     );
     assert_eq!(payload["results"][0]["quota_snapshot"]["plan_type"], "plus");
     assert_eq!(
-        payload["results"][0]["quota_snapshot"]["reset_at"],
+        payload["results"][0]["quota_snapshot"]["exhausted"],
-        1_900_000_000u64
+        json!(false)
-    );
-    assert_eq!(
-        payload["results"][0]["quota_snapshot"]["credits"]["balance"],
-        json!(42.0)
     );
     assert_eq!(
         payload["results"][0]["quota_snapshot"]["windows"]
             .as_array()
             .map(Vec::len),
-        Some(2usize)
+        Some(0usize)
+    );
+    assert_eq!(
+        payload["results"][0]["metadata"]["email"],
+        "codex@example.com"
+    );
+    assert_eq!(
+        payload["results"][0]["metadata"]["account_id"],
+        "acct-codex-123"
     );
     assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
 
@@ -206,12 +193,13 @@ async fn gateway_refreshes_admin_provider_quota_locally_for_codex_with_trusted_a
         .expect("execution runtime request should be captured");
     assert_eq!(
         seen_execution_runtime_request.url,
-        "https://chatgpt.com/backend-api/wham/usage"
+        "https://chatgpt.com/backend-api/me"
     );
     assert_eq!(
         seen_execution_runtime_request.authorization,
         "Bearer sk-codex-123"
     );
+    assert_eq!(seen_execution_runtime_request.accept, "application/json");
     assert_eq!(
         seen_execution_runtime_request.provider_api_format,
         "openai:responses"
@@ -237,32 +225,130 @@ async fn gateway_refreshes_admin_provider_quota_locally_for_codex_with_trusted_a
             .upstream_metadata
             .as_ref()
             .and_then(|value| value.get("codex"))
-            .and_then(|value| value.get("primary_used_percent")),
+            .and_then(|value| value.get("email")),
-        Some(&json!(55.0))
+        Some(&json!("codex@example.com"))
     );
     assert_eq!(
         reloaded[0]
             .upstream_metadata
             .as_ref()
             .and_then(|value| value.get("codex"))
-            .and_then(|value| value.get("primary_reset_at")),
+            .and_then(|value| value.get("account_id")),
-        Some(&json!(1_900_500_000u64))
+        Some(&json!("acct-codex-123"))
     );
-    assert_eq!(
+    assert!(reloaded[0]
-        reloaded[0]
         .upstream_metadata
         .as_ref()
         .and_then(|value| value.get("codex"))
-            .and_then(|value| value.get("secondary_used_percent")),
+        .and_then(|value| value.get("primary_used_percent"))
-        Some(&json!(12.5))
+        .is_none());
+
+    gateway_handle.abort();
+    execution_runtime_handle.abort();
+    upstream_handle.abort();
+}
+
+#[tokio::test]
+async fn gateway_marks_codex_key_invalid_when_backend_me_returns_payment_required() {
+    let upstream = Router::new().route(
+        "/api/admin/endpoints/providers/provider-codex/refresh-quota",
+        any(move |_request: Request| async move {
+            (StatusCode::OK, Body::from("unexpected upstream hit"))
+        }),
     );
+
+    let execution_runtime = Router::new().route(
+        "/v1/execute/sync",
+        any(move |request: Request| async move {
+            let plan: aether_contracts::ExecutionPlan = serde_json::from_slice(
+                &to_bytes(request.into_body(), usize::MAX)
+                    .await
+                    .expect("body should read"),
+            )
+            .expect("plan should parse");
+            let result = aether_contracts::ExecutionResult {
+                request_id: plan.request_id,
+                candidate_id: None,
+                status_code: 402,
+                headers: BTreeMap::new(),
+                body: Some(aether_contracts::ResponseBody {
+                    json_body: Some(json!({
+                        "error": {
+                            "message": "payment required"
+                        }
+                    })),
+                    body_bytes_b64: None,
+                }),
+                telemetry: None,
+                error: None,
+            };
+            (StatusCode::OK, Json(result))
+        }),
+    );
+
+    let provider_catalog_repository = Arc::new(InMemoryProviderCatalogReadRepository::seed(
+        vec![StoredProviderCatalogProvider::new(
+            "provider-codex".to_string(),
+            "codex".to_string(),
+            Some("https://example.com".to_string()),
+            "codex".to_string(),
+        )
+        .expect("provider should build")],
+        vec![sample_endpoint(
+            "endpoint-codex-cli",
+            "provider-codex",
+            "openai:responses",
+            "https://chatgpt.com/backend-api",
+        )],
+        vec![sample_key(
+            "key-codex-a",
+            "provider-codex",
+            "openai:responses",
+            "sk-codex-123",
+        )],
+    ));
+
+    let (_upstream_url, upstream_handle) = start_server(upstream).await;
+    let (execution_runtime_url, execution_runtime_handle) = start_server(execution_runtime).await;
+    let gateway = build_router_with_state(
+        build_state_with_execution_runtime_override(execution_runtime_url.clone())
+            .with_data_state_for_tests(
+                GatewayDataState::with_provider_catalog_repository_for_tests(
+                    provider_catalog_repository.clone(),
+                )
+                .with_encryption_key_for_tests(DEVELOPMENT_ENCRYPTION_KEY),
+            ),
+    );
+    let (gateway_url, gateway_handle) = start_server(gateway).await;
+
+    let response = reqwest::Client::new()
+        .post(format!(
+            "{gateway_url}/api/admin/endpoints/providers/provider-codex/refresh-quota"
+        ))
+        .header(GATEWAY_HEADER, "rust-phase3b")
+        .header(TRUSTED_ADMIN_USER_ID_HEADER, "admin-user-123")
+        .header(TRUSTED_ADMIN_USER_ROLE_HEADER, "admin")
+        .header(TRUSTED_ADMIN_SESSION_ID_HEADER, "session-123")
+        .send()
+        .await
+        .expect("request should succeed");
+
+    assert_eq!(response.status(), StatusCode::OK);
+    let payload: serde_json::Value = response.json().await.expect("json body should parse");
+    assert_eq!(payload["success"], 0);
+    assert_eq!(payload["failed"], 1);
+    assert_eq!(payload["results"][0]["status"], "payment_required");
+    assert_eq!(payload["results"][0]["status_code"], 402);
+
+    let reloaded = provider_catalog_repository
+        .list_keys_by_ids(&["key-codex-a".to_string()])
+        .await
+        .expect("keys should read");
+    assert_eq!(reloaded.len(), 1);
+    assert!(reloaded[0].oauth_invalid_at_unix_secs.is_some());
     assert_eq!(
-        reloaded[0]
+        reloaded[0].oauth_invalid_reason.as_deref(),
-            .upstream_metadata
+        Some("[ACCOUNT_BLOCK] payment required")
-            .as_ref()
-            .and_then(|value| value.get("codex"))
-            .and_then(|value| value.get("secondary_reset_at")),
-        Some(&json!(1_900_000_000u64))
     );
 
     gateway_handle.abort();
@@ -1139,7 +1225,7 @@ async fn gateway_reports_codex_quota_runtime_failures_locally_without_falling_ba
     assert!(payload["results"][0]["message"]
         .as_str()
         .expect("message should be string")
-        .contains("wham/usage 请求执行失败: execution runtime returned HTTP 500"));
+        .contains("backend-api/me 请求执行失败: execution runtime returned HTTP 500"));
     assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
 
     let reloaded = provider_catalog_repository

apps/aether-gateway/src/tests/control/admin/oauth.rs

@@ -194,16 +194,17 @@ fn codex_quota_execution_result(request_id: &str) -> serde_json::Value {
         "headers": {},
         "body": {
             "json_body": {
-                "plan_type": "plus",
+                "user": {
-                "rate_limit": {
+                    "id": "user-codex-123",
-                    "primary_window": {
+                    "email": "alice@example.com"
-                        "used_percent": 10.0,
-                        "window_minutes": 300
                 },
-                    "secondary_window": {
+                "account": {
-                        "used_percent": 20.0,
+                    "id": "acct-codex-123",
-                        "window_minutes": 10080
+                    "plan_type": "plus"
-                    }
+                },
+                "plan": {
+                    "type": "Plus",
+                    "title": "ChatGPT Plus"
                 }
             }
         }
@@ -2453,8 +2454,8 @@ async fn gateway_completes_admin_provider_oauth_key_locally_with_trusted_admin_p
         .as_str()
         .expect("account_state_recheck_error should be string when recheck is attempted");
     assert!(
-        account_state_recheck_error == "wham/usage API 返回状态码 401"
+        account_state_recheck_error == "backend-api/me API 返回状态码 401"
-            || account_state_recheck_error.starts_with("wham/usage 请求执行失败:"),
+            || account_state_recheck_error.starts_with("backend-api/me 请求执行失败:"),
         "unexpected account_state_recheck_error: {account_state_recheck_error}"
     );
     assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
@@ -4924,8 +4925,8 @@ async fn gateway_refreshes_admin_provider_oauth_key_locally_with_trusted_admin_p
             .as_str()
             .expect("account_state_recheck_error should be string when attempted");
         assert!(
-            account_state_recheck_error == "wham/usage API 返回状态码 401"
+            account_state_recheck_error == "backend-api/me API 返回状态码 401"
-                || account_state_recheck_error.starts_with("wham/usage 请求执行失败:"),
+                || account_state_recheck_error.starts_with("backend-api/me 请求执行失败:"),
             "unexpected account_state_recheck_error: {account_state_recheck_error}"
         );
     } else {
@@ -4943,7 +4944,7 @@ async fn gateway_refreshes_admin_provider_oauth_key_locally_with_trusted_admin_p
         .expect("execution runtime request should be captured");
     assert_eq!(
         seen_execution_runtime_request.url,
-        "https://chatgpt.com/backend-api/wham/usage"
+        "https://chatgpt.com/backend-api/me"
     );
     assert_eq!(
         seen_execution_runtime_request.authorization,
@@ -4967,7 +4968,7 @@ async fn gateway_refreshes_admin_provider_oauth_key_locally_with_trusted_admin_p
     .expect("refreshed api key should decrypt");
     assert_eq!(decrypted_api_key, "refreshed-codex-access-token");
     if account_state_recheck_attempted
-        && payload["account_state_recheck_error"] == "wham/usage API 返回状态码 401"
+        && payload["account_state_recheck_error"] == "backend-api/me API 返回状态码 401"
     {
         assert!(stored_key.oauth_invalid_at_unix_secs.is_some());
         assert_eq!(

apps/aether-gateway/src/tests/frontdoor/ai.rs

@@ -167,7 +167,7 @@ async fn gateway_handles_public_openai_models_without_hitting_fallback_probe() {
     assert_eq!(payload["object"], "list");
     assert_eq!(payload["data"][0]["id"], "gpt-4.1");
     assert_eq!(payload["data"][1]["id"], "gpt-5");
-    assert_eq!(payload["data"][0]["owned_by"], "openai");
+    assert_eq!(payload["data"][0]["owned_by"], "aether");
     assert_eq!(*fallback_probe_hits.lock().expect("mutex should lock"), 0);
 
     gateway_handle.abort();
@@ -231,7 +231,7 @@ async fn gateway_handles_public_openai_models_with_cross_format_candidates_witho
         list_response.json().await.expect("json body should parse");
     assert_eq!(list_payload["object"], "list");
     assert_eq!(list_payload["data"][0]["id"], "claude-3-7-sonnet");
-    assert_eq!(list_payload["data"][0]["owned_by"], "claude");
+    assert_eq!(list_payload["data"][0]["owned_by"], "aether");
 
     let detail_response = client
         .get(format!("{gateway_url}/v1/models/claude-3-7-sonnet"))
@@ -245,7 +245,7 @@ async fn gateway_handles_public_openai_models_with_cross_format_candidates_witho
         .await
         .expect("json body should parse");
     assert_eq!(detail_payload["id"], "claude-3-7-sonnet");
-    assert_eq!(detail_payload["owned_by"], "claude");
+    assert_eq!(detail_payload["owned_by"], "aether");
 
     assert_eq!(*fallback_probe_hits.lock().expect("mutex should lock"), 0);
 

apps/aether-gateway/src/tests/frontdoor/public_support.rs

@@ -669,6 +669,7 @@ async fn gateway_handles_public_catalog_site_info_without_proxying_upstream() {
                     vec![
                         ("site_name".to_string(), json!("Aether Local")),
                         ("site_subtitle".to_string(), json!("Rust Only")),
+                        ("show_github_link".to_string(), json!(false)),
                     ],
                 ),
             ),
@@ -685,6 +686,7 @@ async fn gateway_handles_public_catalog_site_info_without_proxying_upstream() {
     let payload: serde_json::Value = response.json().await.expect("json body should parse");
     assert_eq!(payload["site_name"], "Aether Local");
     assert_eq!(payload["site_subtitle"], "Rust Only");
+    assert_eq!(payload["show_github_link"], false);
     assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
 
     gateway_handle.abort();
@@ -757,7 +759,9 @@ async fn gateway_handles_public_catalog_providers_without_proxying_upstream() {
     let providers = payload.as_array().expect("providers should be an array");
     assert_eq!(providers.len(), 2);
     assert_eq!(providers[0]["id"], "provider-openai");
-    assert_eq!(providers[0]["name"], "openai");
+    assert!(providers[0].get("name").is_none());
+    assert!(providers[0].get("description").is_none());
+    assert!(providers[0].get("website").is_none());
     assert_eq!(providers[0]["provider_priority"], 10);
     assert_eq!(providers[0]["endpoints_count"], 1);
     assert_eq!(providers[0]["active_endpoints_count"], 1);
@@ -834,7 +838,8 @@ async fn gateway_handles_public_catalog_models_without_proxying_upstream() {
     let models = payload.as_array().expect("models should be an array");
     assert_eq!(models.len(), 1);
     assert_eq!(models[0]["id"], "model-openai-gpt5");
-    assert_eq!(models[0]["provider_name"], "openai");
+    assert!(models[0].get("provider_id").is_none());
+    assert!(models[0].get("provider_name").is_none());
     assert_eq!(models[0]["name"], "gpt-5");
     assert_eq!(models[0]["display_name"], "GPT 5");
     assert_eq!(models[0]["tags"], serde_json::Value::Null);
@@ -993,7 +998,8 @@ async fn gateway_handles_public_catalog_search_models_without_proxying_upstream(
     let payload: serde_json::Value = response.json().await.expect("json body should parse");
     let models = payload.as_array().expect("models should be an array");
     assert_eq!(models.len(), 1);
-    assert_eq!(models[0]["provider_name"], "claude");
+    assert!(models[0].get("provider_id").is_none());
+    assert!(models[0].get("provider_name").is_none());
     assert_eq!(models[0]["name"], "claude-sonnet-4-5");
     assert_eq!(models[0]["display_name"], "Claude Sonnet 4.5");
     assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
@@ -1101,10 +1107,16 @@ async fn gateway_handles_public_global_models_without_proxying_upstream() {
         }),
     );
 
+    let mut gpt_model = sample_public_global_model("gm-3", "gpt-5", "GPT 5", true);
+    gpt_model.config = Some(json!({
+        "description": "Public description",
+        "model_mappings": ["gpt-5-upstream"],
+        "provider_model_mappings": [{"name": "provider-gpt-5"}],
+    }));
     let global_model_repository = Arc::new(InMemoryGlobalModelReadRepository::seed(vec![
         sample_public_global_model("gm-1", "claude-sonnet-4-5", "Claude Sonnet 4.5", true),
         sample_public_global_model("gm-2", "disabled-model", "Disabled Model", false),
-        sample_public_global_model("gm-3", "gpt-5", "GPT 5", true),
+        gpt_model,
     ]));
 
     let (upstream_url, upstream_handle) = start_server(upstream).await;
@@ -1131,6 +1143,16 @@ async fn gateway_handles_public_global_models_without_proxying_upstream() {
     assert_eq!(payload["models"][0]["name"], "gpt-5");
     assert_eq!(payload["models"][0]["display_name"], "GPT 5");
     assert_eq!(payload["models"][0]["usage_count"], 0);
+    assert_eq!(
+        payload["models"][0]["config"]["description"],
+        "Public description"
+    );
+    assert!(payload["models"][0]["config"]
+        .get("model_mappings")
+        .is_none());
+    assert!(payload["models"][0]["config"]
+        .get("provider_model_mappings")
+        .is_none());
     assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
 
     gateway_handle.abort();
@@ -1409,6 +1431,8 @@ async fn gateway_handles_auth_registration_settings_without_proxying_upstream()
         ("smtp_host".to_string(), json!("smtp.example.com")),
         ("smtp_from_email".to_string(), json!("noreply@example.com")),
         ("password_policy_level".to_string(), json!("strong")),
+        ("turnstile_enabled".to_string(), json!(true)),
+        ("turnstile_site_key".to_string(), json!("site-key-123")),
     ]);
 
     let (upstream_url, upstream_handle) = start_server(upstream).await;
@@ -1434,6 +1458,8 @@ async fn gateway_handles_auth_registration_settings_without_proxying_upstream()
             "require_email_verification": true,
             "email_configured": true,
             "password_policy_level": "strong",
+            "turnstile_enabled": true,
+            "turnstile_site_key": "site-key-123",
         })
     );
     assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
@@ -1689,9 +1715,9 @@ async fn gateway_handles_public_providers_without_proxying_upstream() {
 
     assert_eq!(response.status(), StatusCode::OK);
     let payload: serde_json::Value = response.json().await.expect("json body should parse");
-    assert_eq!(payload["providers"][0]["name"], "openai");
+    assert!(payload["providers"][0].get("name").is_none());
     assert_eq!(payload["providers"][0]["provider_priority"], 10);
-    assert_eq!(payload["providers"][1]["name"], "anthropic");
+    assert!(payload["providers"][1].get("name").is_none());
     assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
 
     gateway_handle.abort();
@@ -1739,7 +1765,7 @@ async fn gateway_handles_public_provider_detail_without_proxying_upstream() {
     assert_eq!(response.status(), StatusCode::OK);
     let payload: serde_json::Value = response.json().await.expect("json body should parse");
     assert_eq!(payload["id"], "provider-1");
-    assert_eq!(payload["name"], "openai");
+    assert!(payload.get("name").is_none());
     assert_eq!(payload["provider_priority"], 10);
 
     let response = reqwest::Client::new()
@@ -1748,11 +1774,9 @@ async fn gateway_handles_public_provider_detail_without_proxying_upstream() {
         .await
         .expect("request should succeed");
 
-    assert_eq!(response.status(), StatusCode::OK);
+    assert_eq!(response.status(), StatusCode::NOT_FOUND);
     let payload: serde_json::Value = response.json().await.expect("json body should parse");
-    assert_eq!(payload["id"], "provider-1");
+    assert_eq!(payload["detail"], "Provider not found");
-    assert_eq!(payload["name"], "openai");
-    assert_eq!(payload["provider_priority"], 10);
     assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
 
     gateway_handle.abort();
@@ -1805,6 +1829,9 @@ async fn gateway_handles_public_providers_with_endpoints_without_proxying_upstre
     assert_eq!(response.status(), StatusCode::OK);
     let payload: serde_json::Value = response.json().await.expect("json body should parse");
     assert_eq!(payload["providers"][0]["endpoints"][0]["id"], "endpoint-1");
+    assert!(payload["providers"][0]["endpoints"][0]
+        .get("base_url")
+        .is_none());
     assert_eq!(
         payload["providers"][0]["endpoints"][0]["api_format"],
         "openai:chat"
@@ -1926,7 +1953,7 @@ async fn gateway_handles_public_test_connection_without_hitting_fallback_probe()
 
     let response = reqwest::Client::new()
         .get(format!(
-            "{gateway_url}/v1/test-connection?provider=openai&model=gpt-5&api_format=openai:chat"
+            "{gateway_url}/v1/test-connection?provider=provider-1&model=gpt-5&api_format=openai:chat"
         ))
         .send()
         .await
@@ -1935,7 +1962,8 @@ async fn gateway_handles_public_test_connection_without_hitting_fallback_probe()
     assert_eq!(response.status(), StatusCode::OK);
     let payload: serde_json::Value = response.json().await.expect("json body should parse");
     assert_eq!(payload["status"], "success");
-    assert_eq!(payload["provider"], "openai");
+    assert!(payload.get("provider").is_none());
+    assert_eq!(payload["provider_id"], "provider-1");
     assert_eq!(payload["api_format"], "openai:chat");
     assert_eq!(payload["response_id"], "resp_local_test");
     assert_eq!(*provider_hits.lock().expect("mutex should lock"), 1);
@@ -4771,7 +4799,13 @@ async fn gateway_handles_users_me_preferences_locally_without_proxying_upstream(
                 "refresh-token-placeholder",
                 now,
             )],
-            std::iter::empty::<crate::data::state::StoredUserPreferenceRecord>(),
+            {
+                let mut preference =
+                    crate::data::state::StoredUserPreferenceRecord::default_for_user("user-auth-1");
+                preference.default_provider_id = Some("provider-openai".to_string());
+                preference.default_provider_name = Some("openai".to_string());
+                vec![preference]
+            },
         )
         .await;
 
@@ -4791,6 +4825,8 @@ async fn gateway_handles_users_me_preferences_locally_without_proxying_upstream(
     assert_eq!(get_payload["language"], "zh-CN");
     assert_eq!(get_payload["timezone"], "Asia/Shanghai");
     assert_eq!(get_payload["notifications"]["email"], true);
+    assert_eq!(get_payload["default_provider_id"], "provider-openai");
+    assert!(get_payload.get("default_provider").is_none());
 
     let put_response = client
         .put(format!("{gateway_url}/api/users/me/preferences"))
@@ -5041,6 +5077,7 @@ async fn gateway_handles_users_me_usage_locally_without_proxying_upstream() {
         105
     );
     assert_eq!(payload["summary_by_model"][0]["total_input_context"], 120);
+    assert!(payload.get("summary_by_provider").is_none());
     assert_eq!(payload["billing"]["id"], "wallet-auth-1");
     assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
 
@@ -7552,8 +7589,10 @@ async fn gateway_handles_users_me_providers_locally_without_proxying_upstream()
     let providers = payload.as_array().expect("providers should be array");
     assert_eq!(providers.len(), 1);
     assert_eq!(providers[0]["id"], "provider-openai");
-    assert_eq!(providers[0]["name"], "openai");
+    assert!(providers[0].get("name").is_none());
+    assert!(providers[0].get("description").is_none());
     assert_eq!(providers[0]["endpoints"][0]["id"], "endpoint-openai-1");
+    assert!(providers[0]["endpoints"][0].get("base_url").is_none());
     assert_eq!(providers[0]["models"][0]["name"], "gpt-5");
     assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
 
@@ -7990,6 +8029,127 @@ async fn gateway_handles_auth_send_verification_code_locally_without_proxying_up
     upstream_handle.abort();
 }
 
+#[tokio::test]
+async fn gateway_requires_turnstile_token_before_auth_send_verification_code() {
+    let (gateway_url, upstream_hits, gateway_handle, upstream_handle) =
+        start_auth_gateway_with_builder(|| {
+            AppState::new()
+                .expect("gateway should build")
+                .with_data_state_for_tests(
+                    crate::data::GatewayDataState::disabled().with_system_config_values_for_tests(
+                        vec![
+                            ("smtp_host".to_string(), json!("smtp.example.com")),
+                            ("smtp_from_email".to_string(), json!("noreply@example.com")),
+                            ("turnstile_enabled".to_string(), json!(true)),
+                            ("turnstile_site_key".to_string(), json!("site-key-123")),
+                            ("turnstile_secret_key".to_string(), json!("secret-key-123")),
+                        ],
+                    ),
+                )
+        })
+        .await;
+
+    let response = reqwest::Client::new()
+        .post(format!("{gateway_url}/api/auth/send-verification-code"))
+        .json(&json!({ "email": "alice@example.com" }))
+        .send()
+        .await
+        .expect("request should succeed");
+
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+    let payload: serde_json::Value = response.json().await.expect("json body should parse");
+    assert_eq!(payload["detail"], "请先完成人机验证");
+    assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
+
+    gateway_handle.abort();
+    upstream_handle.abort();
+}
+
+#[tokio::test]
+async fn gateway_verifies_turnstile_token_before_auth_send_verification_code() {
+    let seen_siteverify_body = Arc::new(Mutex::new(None::<String>));
+    let seen_siteverify_body_clone = Arc::clone(&seen_siteverify_body);
+    let siteverify = Router::new().route(
+        "/turnstile/siteverify",
+        any(move |request: Request| {
+            let seen_siteverify_body_inner = Arc::clone(&seen_siteverify_body_clone);
+            async move {
+                let body = String::from_utf8(
+                    to_bytes(request.into_body(), usize::MAX)
+                        .await
+                        .expect("body should read")
+                        .to_vec(),
+                )
+                .expect("siteverify body should be utf8");
+                *seen_siteverify_body_inner
+                    .lock()
+                    .expect("mutex should lock") = Some(body);
+                (
+                    StatusCode::OK,
+                    Json(json!({
+                        "success": true,
+                        "hostname": "localhost"
+                    })),
+                )
+            }
+        }),
+    );
+    let (siteverify_url, siteverify_handle) = start_server(siteverify).await;
+
+    let (gateway_url, upstream_hits, gateway_handle, upstream_handle) =
+        start_auth_gateway_with_builder(|| {
+            AppState::new()
+                .expect("gateway should build")
+                .with_data_state_for_tests(
+                    crate::data::GatewayDataState::disabled().with_system_config_values_for_tests(
+                        vec![
+                            ("smtp_host".to_string(), json!("smtp.example.com")),
+                            ("smtp_from_email".to_string(), json!("noreply@example.com")),
+                            ("smtp_from_name".to_string(), json!("Aether Mail")),
+                            ("turnstile_enabled".to_string(), json!(true)),
+                            ("turnstile_site_key".to_string(), json!("site-key-123")),
+                            ("turnstile_secret_key".to_string(), json!("secret-key-123")),
+                            (
+                                "turnstile_siteverify_url".to_string(),
+                                json!(format!("{siteverify_url}/turnstile/siteverify")),
+                            ),
+                            (
+                                "turnstile_allowed_hostnames".to_string(),
+                                json!(["localhost"]),
+                            ),
+                        ],
+                    ),
+                )
+        })
+        .await;
+
+    let response = reqwest::Client::new()
+        .post(format!("{gateway_url}/api/auth/send-verification-code"))
+        .json(&json!({
+            "email": "alice@example.com",
+            "turnstile_token": "turnstile-token-123"
+        }))
+        .send()
+        .await
+        .expect("request should succeed");
+
+    assert_eq!(response.status(), StatusCode::OK);
+    let payload: serde_json::Value = response.json().await.expect("json body should parse");
+    assert_eq!(payload["success"], true);
+    let siteverify_body = seen_siteverify_body
+        .lock()
+        .expect("mutex should lock")
+        .clone()
+        .expect("siteverify should be called");
+    assert!(siteverify_body.contains("secret=secret-key-123"));
+    assert!(siteverify_body.contains("response=turnstile-token-123"));
+    assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
+
+    gateway_handle.abort();
+    siteverify_handle.abort();
+    upstream_handle.abort();
+}
+
 #[tokio::test]
 async fn gateway_handles_auth_verification_status_locally_without_proxying_upstream() {
     let now = Utc::now() - chrono::Duration::seconds(10);
@@ -8209,6 +8369,203 @@ async fn gateway_handles_users_me_available_models_locally_without_proxying_upst
     upstream_handle.abort();
 }
 
+#[tokio::test]
+async fn gateway_filters_users_me_available_models_by_group_policy_and_hides_model_mappings() {
+    let now = Utc::now();
+    let mut user = sample_auth_user(now);
+    user.allowed_providers = None;
+    user.allowed_providers_mode = "unrestricted".to_string();
+    user.allowed_models = None;
+    user.allowed_models_mode = "unrestricted".to_string();
+    let access_token = build_test_auth_token(
+        "access",
+        serde_json::Map::from_iter([
+            ("user_id".to_string(), json!(user.id)),
+            ("role".to_string(), json!(user.role)),
+            (
+                "created_at".to_string(),
+                json!(user.created_at.map(|value| value.to_rfc3339())),
+            ),
+            (
+                "session_id".to_string(),
+                json!("session-users-me-group-models"),
+            ),
+        ]),
+        now + chrono::Duration::hours(1),
+    );
+    let mut allowed_model =
+        sample_public_global_model("gm-2", "claude-sonnet-4-5", "Claude Sonnet 4.5", true);
+    allowed_model.config = Some(json!({
+        "description": "Claude detail",
+        "model_mappings": ["claude-upstream"]
+    }));
+    let mut blocked_model = sample_public_global_model("gm-1", "gpt-5", "GPT 5", true);
+    blocked_model.config = Some(json!({
+        "description": "GPT detail",
+        "model_mappings": ["gpt-upstream"]
+    }));
+    let global_model_repository = Arc::new(InMemoryGlobalModelReadRepository::seed(vec![
+        blocked_model,
+        allowed_model,
+    ]));
+    let user_repository: Arc<dyn UserReadRepository> =
+        Arc::new(InMemoryUserReadRepository::seed_auth_users(vec![user]));
+    let group = user_repository
+        .create_user_group(UpsertUserGroupRecord {
+            name: "Claude only".to_string(),
+            description: None,
+            priority: 0,
+            allowed_providers: None,
+            allowed_providers_mode: "unrestricted".to_string(),
+            allowed_api_formats: None,
+            allowed_api_formats_mode: "unrestricted".to_string(),
+            allowed_models: Some(vec!["claude-sonnet-4-5".to_string()]),
+            allowed_models_mode: "specific".to_string(),
+            rate_limit: None,
+            rate_limit_mode: "system".to_string(),
+        })
+        .await
+        .expect("group should create")
+        .expect("group should exist");
+    user_repository
+        .add_user_to_group(&group.id, "user-auth-1")
+        .await
+        .expect("group membership should create");
+
+    let (gateway_url, upstream_hits, gateway_handle, upstream_handle) =
+        start_auth_gateway_with_builder(|| {
+            let data_state = crate::data::GatewayDataState::with_global_model_reader_for_tests(
+                global_model_repository,
+            )
+            .with_user_reader(Arc::clone(&user_repository));
+            AppState::new()
+                .expect("gateway should build")
+                .with_data_state_for_tests(data_state)
+                .with_auth_sessions_for_tests([sample_auth_session(
+                    "user-auth-1",
+                    "session-users-me-group-models",
+                    "device-users-me-group-models",
+                    "refresh-token-placeholder",
+                    now,
+                )])
+        })
+        .await;
+
+    let response = reqwest::Client::new()
+        .get(format!("{gateway_url}/api/users/me/available-models"))
+        .header("authorization", format!("Bearer {access_token}"))
+        .header("x-client-device-id", "device-users-me-group-models")
+        .header("user-agent", "AetherTest/1.0")
+        .send()
+        .await
+        .expect("request should succeed");
+
+    assert_eq!(response.status(), StatusCode::OK);
+    let payload: serde_json::Value = response.json().await.expect("json body should parse");
+    let models = payload["models"]
+        .as_array()
+        .expect("models should be an array");
+    assert_eq!(payload["total"], 1);
+    assert_eq!(models.len(), 1);
+    assert_eq!(models[0]["name"], "claude-sonnet-4-5");
+    assert_eq!(models[0]["config"]["description"], "Claude detail");
+    assert!(models[0]["config"].get("model_mappings").is_none());
+    assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
+
+    gateway_handle.abort();
+    upstream_handle.abort();
+}
+
+#[tokio::test]
+async fn gateway_returns_no_users_me_available_models_when_group_denies_all_models() {
+    let now = Utc::now();
+    let mut user = sample_auth_user(now);
+    user.allowed_providers = None;
+    user.allowed_providers_mode = "unrestricted".to_string();
+    user.allowed_models = None;
+    user.allowed_models_mode = "unrestricted".to_string();
+    let access_token = build_test_auth_token(
+        "access",
+        serde_json::Map::from_iter([
+            ("user_id".to_string(), json!(user.id)),
+            ("role".to_string(), json!(user.role)),
+            (
+                "created_at".to_string(),
+                json!(user.created_at.map(|value| value.to_rfc3339())),
+            ),
+            (
+                "session_id".to_string(),
+                json!("session-users-me-deny-all-models"),
+            ),
+        ]),
+        now + chrono::Duration::hours(1),
+    );
+    let global_model_repository = Arc::new(InMemoryGlobalModelReadRepository::seed(vec![
+        sample_public_global_model("gm-1", "gpt-5", "GPT 5", true),
+        sample_public_global_model("gm-2", "claude-sonnet-4-5", "Claude Sonnet 4.5", true),
+    ]));
+    let user_repository: Arc<dyn UserReadRepository> =
+        Arc::new(InMemoryUserReadRepository::seed_auth_users(vec![user]));
+    let group = user_repository
+        .create_user_group(UpsertUserGroupRecord {
+            name: "No models".to_string(),
+            description: None,
+            priority: 0,
+            allowed_providers: None,
+            allowed_providers_mode: "unrestricted".to_string(),
+            allowed_api_formats: None,
+            allowed_api_formats_mode: "unrestricted".to_string(),
+            allowed_models: None,
+            allowed_models_mode: "deny_all".to_string(),
+            rate_limit: None,
+            rate_limit_mode: "system".to_string(),
+        })
+        .await
+        .expect("group should create")
+        .expect("group should exist");
+    user_repository
+        .add_user_to_group(&group.id, "user-auth-1")
+        .await
+        .expect("group membership should create");
+
+    let (gateway_url, upstream_hits, gateway_handle, upstream_handle) =
+        start_auth_gateway_with_builder(|| {
+            let data_state = crate::data::GatewayDataState::with_global_model_reader_for_tests(
+                global_model_repository,
+            )
+            .with_user_reader(Arc::clone(&user_repository));
+            AppState::new()
+                .expect("gateway should build")
+                .with_data_state_for_tests(data_state)
+                .with_auth_sessions_for_tests([sample_auth_session(
+                    "user-auth-1",
+                    "session-users-me-deny-all-models",
+                    "device-users-me-deny-all-models",
+                    "refresh-token-placeholder",
+                    now,
+                )])
+        })
+        .await;
+
+    let response = reqwest::Client::new()
+        .get(format!("{gateway_url}/api/users/me/available-models"))
+        .header("authorization", format!("Bearer {access_token}"))
+        .header("x-client-device-id", "device-users-me-deny-all-models")
+        .header("user-agent", "AetherTest/1.0")
+        .send()
+        .await
+        .expect("request should succeed");
+
+    assert_eq!(response.status(), StatusCode::OK);
+    let payload: serde_json::Value = response.json().await.expect("json body should parse");
+    assert_eq!(payload["total"], 0);
+    assert_eq!(payload["models"].as_array().map(Vec::len), Some(0));
+    assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
+
+    gateway_handle.abort();
+    upstream_handle.abort();
+}
+
 #[tokio::test]
 async fn gateway_returns_service_unavailable_for_users_me_available_models_without_provider_catalog(
 ) {

apps/aether-gateway/src/tests/frontdoor/public_support/dashboard.rs

@@ -7,6 +7,40 @@ use super::{
     StoredAuthApiKeyExportRecord, StoredAuthApiKeySnapshot, StoredUserAuthRecord,
     StoredUserExportRow, Utc,
 };
+use aether_data_contracts::repository::billing::{
+    BillingReadRepository, StoredBillingModelContext, UserDailyQuotaAvailabilityRecord,
+};
+use aether_data_contracts::DataLayerError;
+
+#[derive(Debug)]
+struct StaticDailyQuotaBillingRepository {
+    user_id: String,
+    quota: UserDailyQuotaAvailabilityRecord,
+}
+
+#[async_trait::async_trait]
+impl BillingReadRepository for StaticDailyQuotaBillingRepository {
+    async fn find_model_context(
+        &self,
+        provider_id: &str,
+        provider_api_key_id: Option<&str>,
+        global_model_name: &str,
+    ) -> Result<Option<StoredBillingModelContext>, DataLayerError> {
+        let _ = (provider_id, provider_api_key_id, global_model_name);
+        Ok(None)
+    }
+
+    async fn find_user_daily_quota_availability(
+        &self,
+        user_id: &str,
+    ) -> Result<Option<UserDailyQuotaAvailabilityRecord>, DataLayerError> {
+        if user_id == self.user_id {
+            Ok(Some(self.quota.clone()))
+        } else {
+            Ok(None)
+        }
+    }
+}
 
 fn stable_dashboard_now() -> chrono::DateTime<Utc> {
     Utc::now()
@@ -173,6 +207,93 @@ async fn gateway_handles_dashboard_stats_locally_without_proxying_upstream() {
     upstream_handle.abort();
 }
 
+#[tokio::test]
+async fn gateway_dashboard_stats_user_wallet_card_uses_wallet_center_balance_breakdown() {
+    let now = stable_dashboard_now();
+    let user = sample_auth_user(now);
+    let access_token = build_test_auth_token(
+        "access",
+        serde_json::Map::from_iter([
+            ("user_id".to_string(), json!(user.id)),
+            ("role".to_string(), json!(user.role)),
+            (
+                "created_at".to_string(),
+                json!(user.created_at.map(|value| value.to_rfc3339())),
+            ),
+            ("session_id".to_string(), json!("session-dashboard-wallet")),
+        ]),
+        chrono::Utc::now() + chrono::Duration::hours(1),
+    );
+    let session = sample_auth_session(
+        "user-auth-1",
+        "session-dashboard-wallet",
+        "device-dashboard-wallet",
+        "refresh-dashboard-wallet",
+        now,
+    );
+    let usage_repository = Arc::new(InMemoryUsageReadRepository::seed(vec![]));
+    let user_repository = Arc::new(InMemoryUserReadRepository::seed_auth_users(vec![
+        user.clone()
+    ]));
+    let mut wallet = sample_auth_wallet("user-auth-1", now);
+    wallet.balance = 7.0;
+    wallet.gift_balance = 3.0;
+    let wallet_repository = Arc::new(InMemoryWalletRepository::seed(vec![wallet]));
+    let billing_repository: Arc<dyn BillingReadRepository> =
+        Arc::new(StaticDailyQuotaBillingRepository {
+            user_id: "user-auth-1".to_string(),
+            quota: UserDailyQuotaAvailabilityRecord {
+                has_active_daily_quota: true,
+                total_quota_usd: 120.0,
+                used_usd: 20.0,
+                remaining_usd: 100.0,
+                allow_wallet_overage: true,
+            },
+        });
+    let auth_repository = Arc::new(InMemoryAuthApiKeySnapshotRepository::seed(Vec::<(
+        Option<String>,
+        StoredAuthApiKeySnapshot,
+    )>::new()));
+
+    let (gateway_url, upstream_hits, gateway_handle, upstream_handle) =
+        start_auth_gateway_with_builder(|| {
+            let data_state = GatewayDataState::with_usage_billing_and_wallet_for_tests(
+                usage_repository,
+                Arc::clone(&billing_repository),
+                wallet_repository,
+            )
+            .with_user_reader(user_repository)
+            .with_auth_api_key_reader(auth_repository);
+            AppState::new()
+                .expect("gateway should build")
+                .with_data_state_for_tests(data_state)
+                .with_auth_sessions_for_tests([session])
+        })
+        .await;
+
+    let response = reqwest::Client::new()
+        .get(format!("{gateway_url}/api/dashboard/stats?days=30"))
+        .header("authorization", format!("Bearer {access_token}"))
+        .header("x-client-device-id", "device-dashboard-wallet")
+        .header("user-agent", "AetherTest/1.0")
+        .send()
+        .await
+        .expect("request should succeed");
+
+    assert_eq!(response.status(), StatusCode::OK);
+    let payload: serde_json::Value = response.json().await.expect("json body should parse");
+    assert_eq!(payload["stats"][2]["name"], "钱包余额");
+    assert_eq!(payload["stats"][2]["value"], "$110.00");
+    assert_eq!(
+        payload["stats"][2]["subValue"],
+        "套餐额度 $100.00 · 钱包余额 $10.00"
+    );
+    assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
+
+    gateway_handle.abort();
+    upstream_handle.abort();
+}
+
 #[tokio::test]
 async fn gateway_dashboard_stats_include_end_of_day_boundary() {
     let now = stable_dashboard_now();
@@ -1071,16 +1192,9 @@ async fn gateway_handles_dashboard_provider_status_locally_without_proxying_upst
         .await
         .expect("request should succeed");
 
-    assert_eq!(response.status(), StatusCode::OK);
+    assert_eq!(response.status(), StatusCode::FORBIDDEN);
     let payload: serde_json::Value = response.json().await.expect("json body should parse");
-    let providers = payload["providers"].as_array().expect("array");
+    assert_eq!(payload["detail"], "仅管理员可查看供应商状态");
-    assert_eq!(providers.len(), 3);
-    assert_eq!(providers[0]["name"], "openai");
-    assert_eq!(providers[0]["requests"], 2);
-    assert_eq!(providers[1]["name"], "claude");
-    assert_eq!(providers[1]["requests"], 1);
-    assert_eq!(providers[2]["name"], "gemini");
-    assert_eq!(providers[2]["requests"], 0);
     assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
 
     gateway_handle.abort();

crates/aether-admin/src/provider/quota.rs

@@ -314,6 +314,133 @@ pub fn parse_codex_wham_usage_response(
     Some(serde_json::Value::Object(result))
 }
 
+fn codex_json_object<'a>(
+    root: &'a serde_json::Map<String, serde_json::Value>,
+    keys: &[&str],
+) -> Option<&'a serde_json::Map<String, serde_json::Value>> {
+    keys.iter()
+        .find_map(|key| root.get(*key).and_then(serde_json::Value::as_object))
+}
+
+fn codex_json_string_from_object(
+    object: Option<&serde_json::Map<String, serde_json::Value>>,
+    keys: &[&str],
+) -> Option<String> {
+    let object = object?;
+    keys.iter()
+        .find_map(|key| coerce_json_string(object.get(*key)))
+}
+
+fn codex_json_string_from_root(
+    root: &serde_json::Map<String, serde_json::Value>,
+    keys: &[&str],
+) -> Option<String> {
+    keys.iter()
+        .find_map(|key| coerce_json_string(root.get(*key)))
+}
+
+fn codex_backend_me_account_object(
+    root: &serde_json::Map<String, serde_json::Value>,
+) -> Option<&serde_json::Map<String, serde_json::Value>> {
+    codex_json_object(root, &["account", "current_account", "selected_account"])
+        .or_else(|| {
+            root.get("accounts")
+                .and_then(serde_json::Value::as_array)?
+                .iter()
+                .filter_map(serde_json::Value::as_object)
+                .find(|account| {
+                    account
+                        .get("is_default")
+                        .or_else(|| account.get("selected"))
+                        .or_else(|| account.get("current"))
+                        .and_then(coerce_json_bool)
+                        .unwrap_or(false)
+                })
+        })
+        .or_else(|| {
+            root.get("accounts")
+                .and_then(serde_json::Value::as_array)?
+                .iter()
+                .find_map(serde_json::Value::as_object)
+        })
+}
+
+fn codex_backend_me_plan_object<'a>(
+    root: &'a serde_json::Map<String, serde_json::Value>,
+    account: Option<&'a serde_json::Map<String, serde_json::Value>>,
+) -> Option<&'a serde_json::Map<String, serde_json::Value>> {
+    codex_json_object(root, &["plan", "subscription", "workspace_plan"]).or_else(|| {
+        account
+            .and_then(|account| account.get("plan"))
+            .and_then(serde_json::Value::as_object)
+    })
+}
+
+pub fn parse_codex_backend_me_response(
+    value: &serde_json::Value,
+    updated_at_unix_secs: u64,
+) -> Option<serde_json::Value> {
+    let root = value.as_object()?;
+    if root.is_empty() {
+        return None;
+    }
+
+    let user = codex_json_object(root, &["user", "auth_user", "profile"]);
+    let account = codex_backend_me_account_object(root);
+    let plan = codex_backend_me_plan_object(root, account);
+    let mut result = serde_json::Map::new();
+
+    if let Some(user_id) = codex_json_string_from_object(user, &["id", "user_id"])
+        .or_else(|| codex_json_string_from_root(root, &["user_id"]))
+    {
+        result.insert("user_id".to_string(), json!(user_id));
+    }
+    if let Some(email) = codex_json_string_from_object(user, &["email"])
+        .or_else(|| codex_json_string_from_root(root, &["email"]))
+    {
+        result.insert("email".to_string(), json!(email));
+    }
+    if let Some(name) = codex_json_string_from_object(user, &["name", "display_name", "full_name"])
+        .or_else(|| codex_json_string_from_root(root, &["name", "display_name", "full_name"]))
+    {
+        result.insert("user_name".to_string(), json!(name));
+    }
+    if let Some(account_id) =
+        codex_json_string_from_object(account, &["id", "account_id", "accountId", "workspace_id"])
+            .or_else(|| {
+                codex_json_string_from_root(root, &["account_id", "accountId", "workspace_id"])
+            })
+    {
+        result.insert("account_id".to_string(), json!(account_id));
+    }
+    if let Some(account_name) =
+        codex_json_string_from_object(account, &["name", "title", "display_name"])
+    {
+        result.insert("account_name".to_string(), json!(account_name));
+    }
+
+    let plan_type = codex_json_string_from_object(
+        account,
+        &["plan_type", "planType", "subscription_plan", "tier"],
+    )
+    .or_else(|| codex_json_string_from_object(plan, &["type", "plan_type", "name", "tier"]))
+    .or_else(|| codex_json_string_from_root(root, &["plan_type", "planType"]));
+    if let Some(plan_type) = normalize_codex_plan_type(plan_type.as_deref()) {
+        result.insert("plan_type".to_string(), json!(plan_type));
+    }
+    if let Some(plan_title) =
+        codex_json_string_from_object(plan, &["title", "display_name", "label"])
+    {
+        result.insert("plan_title".to_string(), json!(plan_title));
+    }
+
+    if result.is_empty() {
+        return None;
+    }
+    result.insert("updated_at".to_string(), json!(updated_at_unix_secs));
+    Some(serde_json::Value::Object(result))
+}
+
 pub fn parse_codex_usage_headers(
     headers: &BTreeMap<String, String>,
     updated_at_unix_secs: u64,
@@ -512,6 +639,14 @@ pub fn codex_structured_invalid_reason(status_code: u16, upstream_message: Optio
         };
         return format!("{OAUTH_ACCOUNT_BLOCK_PREFIX}{detail}");
     }
+    if status_code == 402 {
+        let detail = if message.is_empty() {
+            "Codex 账户需要付款 (402)"
+        } else {
+            message
+        };
+        return format!("{OAUTH_ACCOUNT_BLOCK_PREFIX}{detail}");
+    }
     message.to_string()
 }
 
@@ -521,9 +656,7 @@ pub fn codex_runtime_invalid_reason(
 ) -> Option<String> {
     match status_code {
         401 => Some(codex_structured_invalid_reason(401, upstream_message)),
-        402 if codex_looks_like_workspace_deactivated(upstream_message) => {
+        402 => Some(codex_structured_invalid_reason(402, upstream_message)),
-            Some(codex_structured_invalid_reason(402, upstream_message))
-        }
         403 if codex_looks_like_token_invalidated(upstream_message)
             || codex_looks_like_account_deactivated(upstream_message) =>
         {
@@ -913,9 +1046,9 @@ pub fn parse_chatgpt_web_conversation_init_response(
 mod tests {
     use super::{
         codex_build_invalid_state, codex_runtime_invalid_reason,
-        parse_chatgpt_web_conversation_init_response, parse_codex_wham_usage_response,
+        parse_chatgpt_web_conversation_init_response, parse_codex_backend_me_response,
-        OAUTH_ACCOUNT_BLOCK_PREFIX, OAUTH_EXPIRED_PREFIX, OAUTH_REFRESH_FAILED_PREFIX,
+        parse_codex_wham_usage_response, OAUTH_ACCOUNT_BLOCK_PREFIX, OAUTH_EXPIRED_PREFIX,
-        OAUTH_REQUEST_FAILED_PREFIX,
+        OAUTH_REFRESH_FAILED_PREFIX, OAUTH_REQUEST_FAILED_PREFIX,
     };
     use aether_data_contracts::repository::provider_catalog::StoredProviderCatalogKey;
     use serde_json::json;
@@ -938,6 +1071,14 @@ mod tests {
         );
     }
 
+    #[test]
+    fn codex_runtime_invalid_reason_marks_402_as_account_blocked() {
+        assert_eq!(
+            codex_runtime_invalid_reason(402, Some("payment required")),
+            Some(format!("{OAUTH_ACCOUNT_BLOCK_PREFIX}payment required"))
+        );
+    }
+
     #[test]
     fn codex_runtime_invalid_reason_ignores_generic_403() {
         assert_eq!(codex_runtime_invalid_reason(403, Some("forbidden")), None);
@@ -1067,6 +1208,40 @@ mod tests {
         );
     }
 
+    #[test]
+    fn parses_codex_backend_me_identity_metadata_without_quota_windows() {
+        let parsed = parse_codex_backend_me_response(
+            &json!({
+                "user": {
+                    "id": "user-codex-123",
+                    "email": "codex@example.com",
+                    "name": "Codex User"
+                },
+                "account": {
+                    "id": "acct-codex-123",
+                    "name": "Personal",
+                    "plan_type": "plus"
+                },
+                "plan": {
+                    "type": "Plus",
+                    "title": "ChatGPT Plus"
+                }
+            }),
+            1_777_000_000,
+        )
+        .expect("codex backend me should parse");
+
+        assert_eq!(parsed.get("user_id"), Some(&json!("user-codex-123")));
+        assert_eq!(parsed.get("email"), Some(&json!("codex@example.com")));
+        assert_eq!(parsed.get("account_id"), Some(&json!("acct-codex-123")));
+        assert_eq!(parsed.get("account_name"), Some(&json!("Personal")));
+        assert_eq!(parsed.get("plan_type"), Some(&json!("plus")));
+        assert_eq!(parsed.get("plan_title"), Some(&json!("ChatGPT Plus")));
+        assert_eq!(parsed.get("updated_at"), Some(&json!(1_777_000_000u64)));
+        assert!(parsed.get("primary_used_percent").is_none());
+        assert!(parsed.get("secondary_used_percent").is_none());
+    }
+
     #[test]
     fn parses_chatgpt_web_image_quota_from_conversation_init() {
         let parsed = parse_chatgpt_web_conversation_init_response(

crates/aether-admin/src/system.rs

@@ -667,7 +667,7 @@ struct AdminApiFormatDefinition {
 
 const REQUEST_RECORD_LEVEL_KEY: &str = "request_record_level";
 const LEGACY_REQUEST_LOG_LEVEL_KEY: &str = "request_log_level";
-const SENSITIVE_SYSTEM_CONFIG_KEYS: &[&str] = &["smtp_password"];
+const SENSITIVE_SYSTEM_CONFIG_KEYS: &[&str] = &["smtp_password", "turnstile_secret_key"];
 const ADMIN_API_FORMAT_DEFINITIONS: &[AdminApiFormatDefinition] = &[
     AdminApiFormatDefinition {
         value: "openai:chat",
@@ -1492,6 +1492,9 @@ pub fn admin_system_config_default_value(key: &str) -> Option<serde_json::Value>
         "auto_delete_expired_keys" => Some(json!(false)),
         "email_suffix_mode" => Some(json!("none")),
         "email_suffix_list" => Some(json!([])),
+        "turnstile_enabled" => Some(json!(false)),
+        "turnstile_site_key" => Some(json!("")),
+        "turnstile_allowed_hostnames" => Some(json!([])),
         "enable_format_conversion" => Some(json!(false)),
         "enable_model_directives" => Some(json!(false)),
         "model_directives" => Some(json!({
@@ -2821,6 +2824,7 @@ mod tests {
     fn sensitive_admin_system_config_keys_are_case_insensitive() {
         assert!(is_sensitive_admin_system_config_key("smtp_password"));
         assert!(is_sensitive_admin_system_config_key("SMTP_PASSWORD"));
+        assert!(is_sensitive_admin_system_config_key("turnstile_secret_key"));
         assert!(!is_sensitive_admin_system_config_key("site_name"));
     }
 }

crates/aether-provider-pool/src/lib.rs

@@ -21,8 +21,8 @@ pub use providers::{
     AntigravityProviderPoolAdapter, ChatGptWebProviderPoolAdapter, CodexProviderPoolAdapter,
     DefaultProviderPoolAdapter, KiroPoolQuotaAuthInput, KiroProviderPoolAdapter,
     UnsupportedQuotaProviderPoolAdapter, ANTIGRAVITY_FETCH_AVAILABLE_MODELS_PATH,
-    CHATGPT_WEB_CONVERSATION_INIT_PATH, CHATGPT_WEB_DEFAULT_BASE_URL, CODEX_WHAM_USAGE_URL,
+    CHATGPT_WEB_CONVERSATION_INIT_PATH, CHATGPT_WEB_DEFAULT_BASE_URL, CODEX_BACKEND_ME_URL,
-    KIRO_USAGE_LIMITS_PATH, KIRO_USAGE_SDK_VERSION,
+    CODEX_WHAM_USAGE_URL, KIRO_USAGE_LIMITS_PATH, KIRO_USAGE_SDK_VERSION,
 };
 pub use quota::{
     provider_pool_key_account_quota_exhausted, provider_pool_key_scheduling_label,
@@ -118,6 +118,29 @@ mod tests {
         );
     }
 
+    #[test]
+    fn codex_quota_request_uses_backend_me_probe_endpoint() {
+        let spec = build_codex_pool_quota_request(
+            "key-1",
+            Some(("authorization".to_string(), "Bearer access".to_string())),
+            None,
+            None,
+        )
+        .expect("spec should build");
+
+        assert_eq!(spec.method, "GET");
+        assert_eq!(spec.url, "https://chatgpt.com/backend-api/me");
+        assert_eq!(
+            spec.headers.get("authorization").map(String::as_str),
+            Some("Bearer access")
+        );
+        assert_eq!(
+            spec.headers.get("accept").map(String::as_str),
+            Some("application/json")
+        );
+        assert_eq!(spec.model_name.as_deref(), Some("codex-backend-me"));
+    }
+
     #[test]
     fn codex_quota_request_skips_account_header_for_free_accounts() {
         let spec = build_codex_pool_quota_request(

crates/aether-provider-pool/src/providers/codex.rs

@@ -15,7 +15,8 @@ use crate::quota::{
 };
 use crate::quota_refresh::ProviderPoolQuotaRequestSpec;
 
-pub const CODEX_WHAM_USAGE_URL: &str = "https://chatgpt.com/backend-api/wham/usage";
+pub const CODEX_BACKEND_ME_URL: &str = "https://chatgpt.com/backend-api/me";
+pub const CODEX_WHAM_USAGE_URL: &str = CODEX_BACKEND_ME_URL;
 const PLACEHOLDER_API_KEY: &str = "__placeholder__";
 
 #[derive(Debug, Clone, Default)]
@@ -110,13 +111,13 @@ pub fn build_codex_pool_quota_request(
         provider_name: "codex".to_string(),
         quota_kind: "codex".to_string(),
         method: "GET".to_string(),
-        url: CODEX_WHAM_USAGE_URL.to_string(),
+        url: CODEX_BACKEND_ME_URL.to_string(),
         headers,
         content_type: None,
         json_body: None,
         client_api_format: "openai:responses".to_string(),
         provider_api_format: "openai:responses".to_string(),
-        model_name: Some("codex-wham-usage".to_string()),
+        model_name: Some("codex-backend-me".to_string()),
         accept_invalid_certs: false,
     })
 }

crates/aether-provider-pool/src/providers/mod.rs

@@ -16,7 +16,7 @@ pub use chatgpt_web::{
     CHATGPT_WEB_DEFAULT_BASE_URL,
 };
 pub use codex::CodexProviderPoolAdapter;
-pub use codex::{build_codex_pool_quota_request, CODEX_WHAM_USAGE_URL};
+pub use codex::{build_codex_pool_quota_request, CODEX_BACKEND_ME_URL, CODEX_WHAM_USAGE_URL};
 pub use default::DefaultProviderPoolAdapter;
 pub use kiro::KiroProviderPoolAdapter;
 pub use kiro::{

frontend/src/api/auth.ts

@@ -33,6 +33,7 @@ export interface UserStats {
 
 export interface SendVerificationCodeRequest {
   email: string
+  turnstile_token?: string
 }
 
 export interface SendVerificationCodeResponse {
@@ -67,6 +68,7 @@ export interface RegisterRequest {
   email?: string
   username: string
   password: string
+  turnstile_token?: string
 }
 
 export interface RegisterResponse {
@@ -81,6 +83,8 @@ export interface RegistrationSettingsResponse {
   require_email_verification: boolean
   email_configured: boolean
   password_policy_level: string
+  turnstile_enabled?: boolean
+  turnstile_site_key?: string | null
 }
 
 export interface AuthSettingsResponse {
@@ -153,10 +157,17 @@ export const authApi = {
     return response.data
   },
 
-  async sendVerificationCode(email: string): Promise<SendVerificationCodeResponse> {
+  async sendVerificationCode(
+    email: string,
+    turnstileToken?: string
+  ): Promise<SendVerificationCodeResponse> {
+    const payload: SendVerificationCodeRequest = { email }
+    if (turnstileToken) {
+      payload.turnstile_token = turnstileToken
+    }
     const response = await apiClient.post<SendVerificationCodeResponse>(
       '/api/auth/send-verification-code',
-      { email }
+      payload
     )
     return response.data
   },

frontend/src/api/me.ts

@@ -30,7 +30,7 @@ export interface UserPreferences {
   avatar_url?: string
   bio?: string
   default_provider_id?: string // UUID
-  default_provider?: Record<string, unknown>
+  default_provider?: Record<string, unknown> | string | null // 仅管理员可见
   theme: string
   language: string
   timezone?: string
@@ -52,7 +52,7 @@ export interface ProviderConfig {
 // 使用记录接口
 export interface UsageRecordDetail {
   id: string
-  provider: string
+  provider?: string // 仅管理员可见
   model: string
   input_tokens: number
   effective_input_tokens?: number

frontend/src/composables/__tests__/useSiteInfo.spec.ts

@@ -0,0 +1,34 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const apiClientMocks = vi.hoisted(() => ({
+  get: vi.fn(),
+}))
+
+vi.mock('@/api/client', () => ({
+  default: apiClientMocks,
+}))
+
+describe('useSiteInfo', () => {
+  beforeEach(() => {
+    vi.resetModules()
+    apiClientMocks.get.mockReset()
+  })
+
+  it('loads github link display setting from public site info', async () => {
+    apiClientMocks.get.mockResolvedValue({
+      data: {
+        site_name: 'Custom Aether',
+        site_subtitle: 'Gateway',
+        show_github_link: false,
+      },
+    })
+
+    const { useSiteInfo } = await import('../useSiteInfo')
+    const { siteName, siteSubtitle, showGithubLink, refreshSiteInfo } = useSiteInfo()
+    await refreshSiteInfo()
+
+    expect(siteName.value).toBe('Custom Aether')
+    expect(siteSubtitle.value).toBe('Gateway')
+    expect(showGithubLink.value).toBe(false)
+  })
+})

frontend/src/composables/useSiteInfo.ts

@@ -4,11 +4,13 @@ import apiClient from '@/api/client'
 interface SiteInfo {
   site_name: string
   site_subtitle: string
+  show_github_link?: boolean
 }
 
 // 模块级缓存，所有组件共享同一份数据
 const siteName = ref('Aether')
 const siteSubtitle = ref('AI Gateway')
+const showGithubLink = ref(true)
 const loaded = ref(false)
 let fetchPromise: Promise<void> | null = null
 
@@ -17,6 +19,7 @@ async function fetchSiteInfo() {
     const response = await apiClient.get<SiteInfo>('/api/public/site-info')
     siteName.value = response.data.site_name
     siteSubtitle.value = response.data.site_subtitle
+    showGithubLink.value = response.data.show_github_link !== false
     loaded.value = true
   } catch {
     // 加载失败时保持默认值，允许后续重试
@@ -35,7 +38,7 @@ export function useSiteInfo() {
   if (!loaded.value && !fetchPromise) {
     fetchPromise = fetchSiteInfo()
   }
-  return { siteName, siteSubtitle, refreshSiteInfo }
+  return { siteName, siteSubtitle, showGithubLink, refreshSiteInfo }
 }
 
 // 站点名称变化时同步更新 document.title

frontend/src/features/auth/components/LoginDialog.vue

@@ -227,6 +227,8 @@
     :require-email-verification="requireEmailVerification"
     :email-configured="emailConfigured"
     :password-policy-level="passwordPolicyLevel"
+    :turnstile-enabled="turnstileEnabled"
+    :turnstile-site-key="turnstileSiteKey"
     @success="handleRegisterSuccess"
     @switch-to-login="handleSwitchToLogin"
   />
@@ -270,6 +272,8 @@ const showRegisterDialog = ref(false)
 const requireEmailVerification = ref(false)
 const emailConfigured = ref(true) // 邮箱服务是否已配置
 const passwordPolicyLevel = ref<PasswordPolicyLevel>('weak')
+const turnstileEnabled = ref(false)
+const turnstileSiteKey = ref<string | null>(null)
 const allowRegistration = ref(false) // 由系统配置控制，默认关闭
 
 // LDAP authentication settings
@@ -388,6 +392,8 @@ onMounted(async () => {
     requireEmailVerification.value = !!regSettings.require_email_verification
     emailConfigured.value = !!regSettings.email_configured
     passwordPolicyLevel.value = normalizePasswordPolicyLevel(regSettings.password_policy_level)
+    turnstileEnabled.value = !!regSettings.turnstile_enabled
+    turnstileSiteKey.value = regSettings.turnstile_site_key || null
 
     localEnabled.value = authSettings.local_enabled
     ldapEnabled.value = authSettings.ldap_enabled
@@ -413,6 +419,8 @@ onMounted(async () => {
     requireEmailVerification.value = false
     emailConfigured.value = false
     passwordPolicyLevel.value = 'weak'
+    turnstileEnabled.value = false
+    turnstileSiteKey.value = null
     localEnabled.value = true
     ldapEnabled.value = false
     ldapExclusive.value = false

frontend/src/features/auth/components/RegisterDialog.vue

@@ -55,6 +55,20 @@
           />
         </div>
 
+        <div
+          v-if="turnstileRequired && (!requireEmailVerification || !emailVerified)"
+          class="space-y-2"
+        >
+          <Label>人机验证 <span class="text-destructive">*</span></Label>
+          <TurnstileWidget
+            ref="turnstileWidgetRef"
+            v-model="turnstileToken"
+            :site-key="turnstileSiteKey"
+            :disabled="isLoading || isSendingCode"
+            @error="handleTurnstileError"
+          />
+        </div>
+
         <!-- Verification Code Section (仅当需要邮箱验证时显示) -->
         <div
           v-if="emailConfigured && requireEmailVerification"
@@ -232,7 +246,7 @@
 
 <script setup lang="ts">
 import { ref, computed, watch, onUnmounted, nextTick } from 'vue'
-import { authApi } from '@/api/auth'
+import { authApi, type RegisterRequest } from '@/api/auth'
 import { useToast } from '@/composables/useToast'
 import { parseApiError } from '@/utils/errorParser'
 import {
@@ -245,12 +259,15 @@ import { Dialog } from '@/components/ui'
 import Button from '@/components/ui/button.vue'
 import Input from '@/components/ui/input.vue'
 import Label from '@/components/ui/label.vue'
+import TurnstileWidget from './TurnstileWidget.vue'
 
 interface Props {
   open?: boolean
   requireEmailVerification?: boolean
   emailConfigured?: boolean
   passwordPolicyLevel?: PasswordPolicyLevel
+  turnstileEnabled?: boolean
+  turnstileSiteKey?: string | null
 }
 
 interface Emits {
@@ -263,7 +280,9 @@ const props = withDefaults(defineProps<Props>(), {
   open: false,
   requireEmailVerification: false,
   emailConfigured: true,
-  passwordPolicyLevel: 'weak'
+  passwordPolicyLevel: 'weak',
+  turnstileEnabled: false,
+  turnstileSiteKey: null
 })
 
 const emit = defineEmits<Emits>()
@@ -379,11 +398,26 @@ const codeSentAt = ref<number | null>(null)
 const cooldownSeconds = ref(0)
 const expireMinutes = ref(5)
 const cooldownTimer = ref<number | null>(null)
+const turnstileToken = ref('')
+const turnstileWidgetRef = ref<InstanceType<typeof TurnstileWidget> | null>(null)
+
+const turnstileSiteKey = computed(() => props.turnstileSiteKey || '')
+const turnstileRequired = computed(() => !!props.turnstileEnabled && !!turnstileSiteKey.value)
+
+const resetTurnstile = () => {
+  turnstileToken.value = ''
+  turnstileWidgetRef.value?.reset()
+}
+
+const handleTurnstileError = (message: string) => {
+  showError(message, '人机验证失败')
+}
 
 // Send code cooldown timer
 const canSendCode = computed(() => {
   if (!formData.value.email) return false
   if (cooldownSeconds.value > 0) return false
+  if (turnstileRequired.value && !turnstileToken.value) return false
   return true
 })
 
@@ -391,6 +425,7 @@ const sendCodeButtonText = computed(() => {
   if (isSendingCode.value) return '发送中...'
   if (emailVerified.value) return '验证成功'
   if (cooldownSeconds.value > 0) return `${cooldownSeconds.value}秒后重试`
+  if (turnstileRequired.value && !turnstileToken.value) return '请先完成人机验证'
   if (codeSentAt.value) return '重新发送验证码'
   return '发送验证码'
 })
@@ -428,6 +463,8 @@ const canSubmit = computed(() => {
     if (!formData.value.email || !emailVerified.value) {
       return false
     }
+  } else if (turnstileRequired.value && !turnstileToken.value) {
+    return false
   }
 
   // Check password match
@@ -484,6 +521,7 @@ watch(
         cooldownTimer.value = null
       }
       codeDigits.value = ['', '', '', '', '', '']
+      resetTurnstile()
     }
 
     // 清除之前的定时器
@@ -551,6 +589,7 @@ const resetForm = () => {
   isSendingCode.value = false
   codeSentAt.value = null
   cooldownSeconds.value = 0
+  resetTurnstile()
 
   // Reset password field nonce
   formNonce.value = createFormNonce()
@@ -581,9 +620,13 @@ const handleSendCode = async () => {
   isSendingCode.value = true
 
   try {
-    const response = await authApi.sendVerificationCode(formData.value.email)
+    const response = await authApi.sendVerificationCode(
+      formData.value.email,
+      turnstileRequired.value ? turnstileToken.value : undefined
+    )
 
     if (response.success) {
+      resetTurnstile()
       codeSentAt.value = Date.now()
       if (response.expire_minutes) {
         expireMinutes.value = response.expire_minutes
@@ -599,9 +642,11 @@ const handleSendCode = async () => {
         codeInputRefs.value[0]?.focus()
       })
     } else {
+      resetTurnstile()
       showError(response.message || '请稍后重试', '发送失败')
     }
   } catch (error: unknown) {
+    resetTurnstile()
     showError(parseApiError(error, '网络错误，请重试'), '发送失败')
   } finally {
     isSendingCode.value = false
@@ -657,13 +702,17 @@ const handleSubmit = async () => {
     showError('请先完成邮箱验证')
     return
   }
+  if (!props.requireEmailVerification && turnstileRequired.value && !turnstileToken.value) {
+    showError('请先完成人机验证')
+    return
+  }
 
   isLoading.value = true
   loadingText.value = '注册中...'
 
   try {
     // 构建请求数据：邮箱可选
-    const registerData: { email?: string; username: string; password: string } = {
+    const registerData: RegisterRequest = {
       username: formData.value.username,
       password: formData.value.password
     }
@@ -671,6 +720,9 @@ const handleSubmit = async () => {
     if (formData.value.email && formData.value.email.trim()) {
       registerData.email = formData.value.email
     }
+    if (!props.requireEmailVerification && turnstileRequired.value) {
+      registerData.turnstile_token = turnstileToken.value
+    }
 
     const response = await authApi.register(registerData)
 
@@ -679,6 +731,7 @@ const handleSubmit = async () => {
     emit('success')
     isOpen.value = false
   } catch (error: unknown) {
+    resetTurnstile()
     showError(parseApiError(error, '注册失败，请重试'), '注册失败')
   } finally {
     isLoading.value = false

frontend/src/features/auth/components/TurnstileWidget.vue

@@ -0,0 +1,157 @@
+<template>
+  <div class="space-y-2">
+    <div
+      ref="containerRef"
+      class="min-h-[65px]"
+      :class="disabled ? 'pointer-events-none opacity-60' : ''"
+    />
+    <p
+      v-if="errorMessage"
+      class="text-xs text-destructive"
+    >
+      {{ errorMessage }}
+    </p>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { nextTick, onBeforeUnmount, onMounted, ref, watch } from 'vue'
+
+const TURNSTILE_SCRIPT_URL = 'https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit'
+
+let loadTurnstilePromise: Promise<void> | null = null
+
+interface TurnstileApi {
+  render: (container: HTMLElement, options: Record<string, unknown>) => string
+  reset: (widgetId: string) => void
+  remove: (widgetId: string) => void
+}
+
+declare global {
+  interface Window {
+    turnstile?: TurnstileApi
+  }
+}
+
+const props = withDefaults(defineProps<{
+  modelValue?: string
+  siteKey: string
+  disabled?: boolean
+}>(), {
+  modelValue: '',
+  disabled: false,
+})
+
+const emit = defineEmits<{
+  'update:modelValue': [value: string]
+  error: [message: string]
+}>()
+
+const containerRef = ref<HTMLElement | null>(null)
+const widgetId = ref<string | null>(null)
+const errorMessage = ref('')
+
+function loadTurnstileScript(): Promise<void> {
+  if (window.turnstile) {
+    return Promise.resolve()
+  }
+  if (loadTurnstilePromise) {
+    return loadTurnstilePromise
+  }
+
+  loadTurnstilePromise = new Promise((resolve, reject) => {
+    const existing = document.querySelector<HTMLScriptElement>(
+      `script[src="${TURNSTILE_SCRIPT_URL}"]`
+    )
+    if (existing) {
+      existing.addEventListener('load', () => resolve(), { once: true })
+      existing.addEventListener('error', () => {
+        existing.remove()
+        loadTurnstilePromise = null
+        reject(new Error('turnstile script failed'))
+      }, { once: true })
+      return
+    }
+
+    const script = document.createElement('script')
+    script.src = TURNSTILE_SCRIPT_URL
+    script.async = true
+    script.defer = true
+    script.onload = () => resolve()
+    script.onerror = () => {
+      script.remove()
+      loadTurnstilePromise = null
+      reject(new Error('turnstile script failed'))
+    }
+    document.head.appendChild(script)
+  })
+
+  return loadTurnstilePromise
+}
+
+function clearWidget() {
+  if (widgetId.value && window.turnstile) {
+    window.turnstile.remove(widgetId.value)
+  }
+  widgetId.value = null
+  emit('update:modelValue', '')
+}
+
+async function renderWidget() {
+  if (!props.siteKey || !containerRef.value) return
+  clearWidget()
+  errorMessage.value = ''
+  try {
+    await loadTurnstileScript()
+    await nextTick()
+    if (!window.turnstile || !containerRef.value) return
+    widgetId.value = window.turnstile.render(containerRef.value, {
+      sitekey: props.siteKey,
+      callback: (token: string) => {
+        errorMessage.value = ''
+        emit('update:modelValue', token)
+      },
+      'expired-callback': () => {
+        emit('update:modelValue', '')
+      },
+      'error-callback': () => {
+        const message = '人机验证加载失败，请重试'
+        errorMessage.value = message
+        emit('update:modelValue', '')
+        emit('error', message)
+      },
+    })
+  } catch {
+    const message = '人机验证加载失败，请重试'
+    errorMessage.value = message
+    emit('update:modelValue', '')
+    emit('error', message)
+  }
+}
+
+function reset() {
+  emit('update:modelValue', '')
+  errorMessage.value = ''
+  if (widgetId.value && window.turnstile) {
+    window.turnstile.reset(widgetId.value)
+    return
+  }
+  void renderWidget()
+}
+
+onMounted(() => {
+  void renderWidget()
+})
+
+onBeforeUnmount(() => {
+  if (widgetId.value && window.turnstile) {
+    window.turnstile.remove(widgetId.value)
+  }
+})
+
+watch(() => props.siteKey, () => {
+  void renderWidget()
+})
+
+defineExpose({ reset })
+</script>

frontend/src/features/auth/components/__tests__/RegisterDialog.spec.ts

@@ -0,0 +1,205 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { createApp, defineComponent, h, nextTick, type App } from 'vue'
+
+import RegisterDialog from '../RegisterDialog.vue'
+
+const authApiMocks = vi.hoisted(() => ({
+  sendVerificationCode: vi.fn(),
+  getVerificationStatus: vi.fn(),
+  verifyEmail: vi.fn(),
+  register: vi.fn(),
+}))
+
+vi.mock('@/api/auth', () => ({
+  authApi: authApiMocks,
+}))
+
+vi.mock('@/composables/useToast', () => ({
+  useToast: () => ({
+    success: vi.fn(),
+    error: vi.fn(),
+  }),
+}))
+
+vi.mock('@/utils/errorParser', () => ({
+  parseApiError: (_error: unknown, fallback: string) => fallback,
+}))
+
+vi.mock('../TurnstileWidget.vue', () => ({
+  default: defineComponent({
+    name: 'TurnstileWidgetStub',
+    props: {
+      modelValue: { type: String, default: '' },
+      siteKey: { type: String, required: true },
+    },
+    emits: ['update:modelValue'],
+    setup(_props, { emit, expose }) {
+      expose({ reset: vi.fn() })
+      return () =>
+        h('button', {
+          type: 'button',
+          'data-testid': 'turnstile-widget',
+          onClick: () => emit('update:modelValue', 'turnstile-token-123'),
+        }, 'Turnstile')
+    },
+  }),
+}))
+
+vi.mock('@/components/ui', async () => {
+  const { defineComponent, h } = await import('vue')
+  return {
+    Dialog: defineComponent({
+      name: 'DialogStub',
+      props: { open: { type: Boolean, default: false } },
+      emits: ['update:open'],
+      setup(props, { slots }) {
+        return () => props.open
+          ? h('div', [slots.default?.(), slots.footer?.()])
+          : null
+      },
+    }),
+  }
+})
+
+vi.mock('@/components/ui/button.vue', async () => {
+  const { defineComponent, h } = await import('vue')
+  return {
+    default: defineComponent({
+      name: 'ButtonStub',
+      props: {
+        disabled: { type: Boolean, default: false },
+        type: { type: String, default: 'button' },
+      },
+      emits: ['click'],
+      setup(props, { attrs, emit, slots }) {
+        return () => h('button', {
+          ...attrs,
+          type: props.type,
+          disabled: props.disabled,
+          onClick: (event: MouseEvent) => emit('click', event),
+        }, slots.default?.())
+      },
+    }),
+  }
+})
+
+vi.mock('@/components/ui/input.vue', async () => {
+  const { defineComponent, h } = await import('vue')
+  return {
+    default: defineComponent({
+      name: 'InputStub',
+      props: {
+        modelValue: { type: [String, Number], default: '' },
+        disabled: { type: Boolean, default: false },
+        type: { type: String, default: 'text' },
+        id: { type: String, default: undefined },
+      },
+      emits: ['update:modelValue'],
+      setup(props, { attrs, emit }) {
+        return () => h('input', {
+          ...attrs,
+          id: props.id,
+          type: props.type,
+          disabled: props.disabled,
+          value: props.modelValue,
+          onInput: (event: Event) => emit('update:modelValue', (event.target as HTMLInputElement).value),
+        })
+      },
+    }),
+  }
+})
+
+vi.mock('@/components/ui/label.vue', async () => {
+  const { defineComponent, h } = await import('vue')
+  return {
+    default: defineComponent({
+      name: 'LabelStub',
+      setup(_props, { attrs, slots }) {
+        return () => h('label', attrs, slots.default?.())
+      },
+    }),
+  }
+})
+
+const mountedApps: Array<{ app: App, root: HTMLElement }> = []
+
+function mountRegisterDialog() {
+  const root = document.createElement('div')
+  document.body.appendChild(root)
+  const app = createApp(RegisterDialog, {
+    open: true,
+    requireEmailVerification: true,
+    emailConfigured: true,
+    turnstileEnabled: true,
+    turnstileSiteKey: 'site-key-123',
+    'onUpdate:open': vi.fn(),
+  })
+  app.mount(root)
+  mountedApps.push({ app, root })
+  return root
+}
+
+async function settle() {
+  for (let index = 0; index < 4; index += 1) {
+    await Promise.resolve()
+    await nextTick()
+  }
+}
+
+beforeEach(() => {
+  authApiMocks.sendVerificationCode.mockReset()
+  authApiMocks.getVerificationStatus.mockReset()
+  authApiMocks.verifyEmail.mockReset()
+  authApiMocks.register.mockReset()
+  authApiMocks.getVerificationStatus.mockResolvedValue({
+    has_pending_code: false,
+    is_verified: false,
+    cooldown_remaining: null,
+    code_expires_in: null,
+  })
+  authApiMocks.sendVerificationCode.mockResolvedValue({
+    success: true,
+    message: 'ok',
+    expire_minutes: 5,
+  })
+})
+
+afterEach(() => {
+  for (const { app, root } of mountedApps.splice(0)) {
+    app.unmount()
+    root.remove()
+  }
+  document.body.innerHTML = ''
+})
+
+describe('RegisterDialog Turnstile verification flow', () => {
+  it('shows Turnstile before sending code and includes the token in the request', async () => {
+    const root = mountRegisterDialog()
+    await settle()
+
+    expect(root.textContent).toContain('Turnstile')
+    const emailInput = root.querySelector('#reg-email') as HTMLInputElement
+    emailInput.value = 'alice@example.com'
+    emailInput.dispatchEvent(new Event('input'))
+    await settle()
+
+    const sendButtonBeforeToken = Array.from(root.querySelectorAll('button'))
+      .find((button) => button.textContent?.includes('请先完成人机验证')) as HTMLButtonElement
+    expect(sendButtonBeforeToken.disabled).toBe(true)
+
+    const turnstileButton = root.querySelector('[data-testid="turnstile-widget"]') as HTMLButtonElement
+    turnstileButton.click()
+    await settle()
+
+    const sendButton = Array.from(root.querySelectorAll('button'))
+      .find((button) => button.textContent?.includes('发送验证码')) as HTMLButtonElement
+    expect(sendButton.disabled).toBe(false)
+    sendButton.click()
+    await settle()
+
+    expect(authApiMocks.sendVerificationCode).toHaveBeenCalledWith(
+      'alice@example.com',
+      'turnstile-token-123'
+    )
+  })
+})

frontend/src/layouts/MainLayout.vue

@@ -325,6 +325,7 @@
           </button>
           <!-- GitHub Link -->
           <a
+            v-if="showGithubLink"
             href="https://github.com/fawney19/Aether"
             target="_blank"
             rel="noopener noreferrer"
@@ -412,7 +413,7 @@ const route = useRoute()
 const authStore = useAuthStore()
 const moduleStore = useModuleStore()
 const { themeMode, toggleDarkMode } = useDarkMode()
-const { siteName, siteSubtitle } = useSiteInfo()
+const { siteName, siteSubtitle, showGithubLink } = useSiteInfo()
 const isDemo = computed(() => isDemoMode())
 const isAdmin = computed(() => authStore.user?.role === 'admin')
 

frontend/src/views/admin/SystemSettings.vue

@@ -14,11 +14,13 @@
             id="section-site-info"
             :site-name="systemConfig.site_name"
             :site-subtitle="systemConfig.site_subtitle"
+            :show-github-link="systemConfig.show_github_link"
             :loading="siteInfoLoading"
             :has-changes="hasSiteInfoChanges"
             @save="saveSiteInfo"
             @update:site-name="systemConfig.site_name = $event"
             @update:site-subtitle="systemConfig.site_subtitle = $event"
+            @update:show-github-link="systemConfig.show_github_link = $event"
           />
 
           <!-- 配置导出/导入 -->

frontend/src/views/admin/system-settings/SiteInfoSection.vue

@@ -51,6 +51,21 @@
           显示在导航栏品牌名称下方
         </p>
       </div>
+      <div class="md:col-span-2 flex items-center justify-between gap-4 rounded-lg border border-border/60 bg-muted/20 p-4">
+        <div>
+          <Label class="block text-sm font-medium">
+            GitHub 仓库入口
+          </Label>
+          <p class="mt-1 text-xs text-muted-foreground">
+            控制首页、指南页和控制台顶部的 GitHub 链接是否展示
+          </p>
+        </div>
+        <Switch
+          :model-value="showGithubLink"
+          :disabled="loading"
+          @update:model-value="$emit('update:showGithubLink', $event)"
+        />
+      </div>
     </div>
   </CardSection>
 </template>
@@ -59,11 +74,13 @@
 import Button from '@/components/ui/button.vue'
 import Input from '@/components/ui/input.vue'
 import Label from '@/components/ui/label.vue'
+import Switch from '@/components/ui/switch.vue'
 import { CardSection } from '@/components/layout'
 
 defineProps<{
   siteName: string
   siteSubtitle: string
+  showGithubLink: boolean
   loading: boolean
   hasChanges: boolean
 }>()
@@ -72,5 +89,6 @@ defineEmits<{
   save: []
   'update:siteName': [value: string]
   'update:siteSubtitle': [value: string]
+  'update:showGithubLink': [value: boolean]
 }>()
 </script>

frontend/src/views/admin/system-settings/__tests__/SiteInfoSection.spec.ts

@@ -0,0 +1,77 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { createApp, defineComponent, h, nextTick, type App } from 'vue'
+
+import SiteInfoSection from '../SiteInfoSection.vue'
+
+vi.mock('@/components/layout', async () => {
+  const { defineComponent, h } = await import('vue')
+  return {
+    CardSection: defineComponent({
+      name: 'CardSectionStub',
+      props: {
+        title: String,
+        description: String,
+      },
+      setup(props, { slots }) {
+        return () => h('section', [
+          h('h2', props.title),
+          h('p', props.description),
+          slots.actions?.(),
+          slots.default?.(),
+        ])
+      },
+    }),
+  }
+})
+
+vi.mock('@/components/ui/button.vue', () => ({
+  default: defineComponent({
+    name: 'ButtonStub',
+    setup(_, { slots }) {
+      return () => h('button', slots.default?.())
+    },
+  }),
+}))
+
+const mountedApps: Array<{ app: App, root: HTMLElement }> = []
+
+function mountSection(onUpdateShowGithubLink = vi.fn()) {
+  const root = document.createElement('div')
+  document.body.appendChild(root)
+  const app = createApp(SiteInfoSection, {
+    siteName: 'Aether',
+    siteSubtitle: 'AI Gateway',
+    showGithubLink: false,
+    loading: false,
+    hasChanges: true,
+    onSave: vi.fn(),
+    'onUpdate:siteName': vi.fn(),
+    'onUpdate:siteSubtitle': vi.fn(),
+    'onUpdate:showGithubLink': onUpdateShowGithubLink,
+  })
+  app.mount(root)
+  mountedApps.push({ app, root })
+  return { root, onUpdateShowGithubLink }
+}
+
+afterEach(() => {
+  for (const { app, root } of mountedApps.splice(0)) {
+    app.unmount()
+    root.remove()
+  }
+  document.body.innerHTML = ''
+})
+
+describe('SiteInfoSection', () => {
+  it('renders and emits the github link display switch', async () => {
+    const { root, onUpdateShowGithubLink } = mountSection()
+    await nextTick()
+
+    expect(root.textContent).toContain('GitHub 仓库入口')
+    const switchButton = root.querySelector('[role="switch"]') as HTMLButtonElement | null
+    expect(switchButton?.getAttribute('aria-checked')).toBe('false')
+
+    switchButton?.click()
+    expect(onUpdateShowGithubLink).toHaveBeenCalledWith(true)
+  })
+})

frontend/src/views/admin/system-settings/composables/useSystemConfig.ts

@@ -8,6 +8,7 @@ export interface SystemConfig {
   // 站点信息
   site_name: string
   site_subtitle: string
+  show_github_link: boolean
   // 网络代理
   system_proxy_node_id: string | null
   // 基础配置
@@ -49,6 +50,7 @@ const CONFIG_KEYS = [
   // 站点信息
   'site_name',
   'site_subtitle',
+  'show_github_link',
   // 网络代理
   'system_proxy_node_id',
   // 基础配置
@@ -91,6 +93,7 @@ function createDefaultConfig(): SystemConfig {
     // 站点信息
     site_name: 'Aether',
     site_subtitle: 'AI Gateway',
+    show_github_link: true,
     // 网络代理
     system_proxy_node_id: null,
     // 基础配置
@@ -149,7 +152,8 @@ export function useSystemConfig() {
     if (!originalConfig.value) return false
     return (
       systemConfig.value.site_name !== originalConfig.value.site_name ||
-      systemConfig.value.site_subtitle !== originalConfig.value.site_subtitle
+      systemConfig.value.site_subtitle !== originalConfig.value.site_subtitle ||
+      systemConfig.value.show_github_link !== originalConfig.value.show_github_link
     )
   })
 
@@ -273,6 +277,11 @@ export function useSystemConfig() {
           value: systemConfig.value.site_subtitle,
           description: '站点副标题',
         },
+        {
+          key: 'show_github_link',
+          value: systemConfig.value.show_github_link,
+          description: '是否显示 GitHub 仓库入口',
+        },
       ]
       await Promise.all(
         configItems.map((item) =>
@@ -282,6 +291,7 @@ export function useSystemConfig() {
       if (originalConfig.value) {
         originalConfig.value.site_name = systemConfig.value.site_name
         originalConfig.value.site_subtitle = systemConfig.value.site_subtitle
+        originalConfig.value.show_github_link = systemConfig.value.show_github_link
       }
       await refreshSiteInfo()
       success('站点信息已保存')

frontend/src/views/public/Home.vue

@@ -75,6 +75,7 @@
             />
           </button>
           <a
+            v-if="showGithubLink"
             href="https://github.com/fawney19/Aether"
             target="_blank"
             rel="noopener noreferrer"
@@ -89,7 +90,10 @@
       <!-- Desktop layout (>= md): Centered nav with balanced spacing -->
       <div class="h-16 hidden md:flex items-center justify-between px-8">
         <!-- Left spacer for balance (matches right icons width) -->
-        <div class="w-[76px] shrink-0" />
+        <div
+          class="shrink-0"
+          :class="showGithubLink ? 'w-[76px]' : 'w-9'"
+        />
 
         <!-- Center: Logo + Nav + Login Button -->
         <div class="flex items-center">
@@ -186,6 +190,7 @@
             />
           </button>
           <a
+            v-if="showGithubLink"
             href="https://github.com/fawney19/Aether"
             target="_blank"
             rel="noopener noreferrer"
@@ -495,7 +500,7 @@ import {
 const authStore = useAuthStore()
 const { isDark, themeMode, toggleDarkMode } = useDarkMode()
 const { copyToClipboard } = useClipboard()
-const { siteName, siteSubtitle } = useSiteInfo()
+const { siteName, siteSubtitle, showGithubLink } = useSiteInfo()
 
 const dashboardPath = computed(() =>
   authStore.canAccessAdmin ? '/admin/dashboard' : '/dashboard'

frontend/src/views/public/guide/GuideLayout.vue

@@ -261,6 +261,7 @@
             />
           </button>
           <a
+            v-if="showGithubLink"
             href="https://github.com/fawney19/Aether"
             target="_blank"
             rel="noopener noreferrer"
@@ -340,7 +341,7 @@ import { guideNavItems } from './guide-config'
 
 const route = useRoute()
 const { themeMode, toggleDarkMode } = useDarkMode()
-const { siteName, siteSubtitle } = useSiteInfo()
+const { siteName, siteSubtitle, showGithubLink } = useSiteInfo()
 
 const mobileMenuOpen = ref(false)
 const baseUrl = ref(typeof window !== 'undefined' ? window.location.origin : 'https://your-aether.com')

frontend/src/views/public/guide/Overview.vue

@@ -12,10 +12,12 @@ import {
   Zap,
 } from 'lucide-vue-next'
 import { panelClasses } from './guide-config'
+import { useSiteInfo } from '@/composables/useSiteInfo'
 
 // 部署步骤数据
 const activeDeployTab = ref(0)
 const copiedStep = ref<string | null>(null)
+const { showGithubLink } = useSiteInfo()
 
 const productionSteps = [
   {
@@ -397,6 +399,7 @@ function copyStep(stepId: string, code: string) {
           <h3>1. Aether-Proxy</h3>
           <p>Rust实现, 超小资源占有, 适合性能低的VPS直接使用。</p>
           <a
+            v-if="showGithubLink"
             href="https://github.com/fawney19/Aether/tree/main/aether-proxy"
             target="_blank"
             rel="noopener noreferrer"

frontend/src/views/shared/Dashboard.vue

@@ -789,7 +789,7 @@
 </template>
 
 <script setup lang="ts">
-import { ref, onMounted, computed, onBeforeUnmount, nextTick, watch } from 'vue'
+import { ref, onMounted, computed, onBeforeUnmount, nextTick, watch, markRaw } from 'vue'
 import { useAuthStore } from '@/stores/auth'
 import { dashboardApi, type DashboardStat, type DailyStat, type ProviderSummary } from '@/api/dashboard'
 import { getDateRangeFromPeriod } from '@/features/usage/composables'
@@ -1328,7 +1328,7 @@ async function loadDashboardData() {
     })
     stats.value = statsData.stats.map(stat => ({
       ...stat,
-      icon: iconMap[stat.icon] || Activity
+      icon: markRaw(iconMap[stat.icon] || Activity)
     }))
     if (statsData.today) todayStats.value = statsData.today
     if (isAdmin.value) {

frontend/src/views/shared/__tests__/Dashboard.spec.ts

@@ -0,0 +1,169 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { createApp, defineComponent, h, nextTick, type App } from 'vue'
+
+import Dashboard from '../Dashboard.vue'
+
+const dashboardApiMocks = vi.hoisted(() => ({
+  getStats: vi.fn(),
+  getDailyStats: vi.fn(),
+}))
+
+vi.mock('@/stores/auth', () => ({
+  useAuthStore: () => ({
+    canAccessAdmin: false,
+    isAdmin: false,
+    isAuditAdmin: false,
+  }),
+}))
+
+vi.mock('@/api/dashboard', () => ({
+  dashboardApi: dashboardApiMocks,
+}))
+
+vi.mock('@/api/announcements', () => ({
+  announcementApi: {
+    getAnnouncements: vi.fn().mockResolvedValue({ items: [] }),
+    markAsRead: vi.fn().mockResolvedValue({}),
+  },
+}))
+
+vi.mock('@/components/charts/BarChart.vue', async () => {
+  const { defineComponent, h } = await import('vue')
+  return { default: defineComponent({ name: 'BarChartStub', setup: () => () => h('div') }) }
+})
+
+vi.mock('@/components/charts/DoughnutChart.vue', async () => {
+  const { defineComponent, h } = await import('vue')
+  return { default: defineComponent({ name: 'DoughnutChartStub', setup: () => () => h('div') }) }
+})
+
+vi.mock('@/components/charts/LineChart.vue', async () => {
+  const { defineComponent, h } = await import('vue')
+  return { default: defineComponent({ name: 'LineChartStub', setup: () => () => h('div') }) }
+})
+
+vi.mock('@/components/common', async () => {
+  const { defineComponent, h } = await import('vue')
+  return {
+    TimeRangePicker: defineComponent({
+      name: 'TimeRangePickerStub',
+      setup() {
+        return () => h('div')
+      },
+    }),
+  }
+})
+
+vi.mock('@/components/ui', async () => {
+  const { defineComponent, h } = await import('vue')
+  const passthrough = (name: string, tag = 'div') => defineComponent({
+    name,
+    setup(_, { slots }) {
+      return () => h(tag, slots.default?.())
+    },
+  })
+  return {
+    Card: passthrough('CardStub', 'section'),
+    Badge: passthrough('BadgeStub', 'span'),
+    Button: passthrough('ButtonStub', 'button'),
+    Skeleton: defineComponent({ name: 'SkeletonStub', setup: () => () => h('div') }),
+    Dialog: passthrough('DialogStub'),
+    Table: passthrough('TableStub', 'table'),
+    TableHeader: passthrough('TableHeaderStub', 'thead'),
+    TableBody: passthrough('TableBodyStub', 'tbody'),
+    TableRow: passthrough('TableRowStub', 'tr'),
+    TableHead: passthrough('TableHeadStub', 'th'),
+    TableCell: passthrough('TableCellStub', 'td'),
+  }
+})
+
+vi.mock('lucide-vue-next', async () => {
+  const Icon = defineComponent({
+    name: 'IconStub',
+    setup() {
+      return () => h('span')
+    },
+  })
+  return {
+    Users: Icon,
+    Activity: Icon,
+    TrendingUp: Icon,
+    DollarSign: Icon,
+    Key: Icon,
+    Hash: Icon,
+    Zap: Icon,
+    Bell: Icon,
+    AlertCircle: Icon,
+    AlertTriangle: Icon,
+    Info: Icon,
+    Wrench: Icon,
+    Loader2: Icon,
+    Clock: Icon,
+    Database: Icon,
+    Shuffle: Icon,
+  }
+})
+
+const mountedApps: Array<{ app: App, root: HTMLElement }> = []
+
+function mountDashboard() {
+  const root = document.createElement('div')
+  document.body.appendChild(root)
+  const app = createApp(Dashboard)
+  app.mount(root)
+  mountedApps.push({ app, root })
+  return root
+}
+
+async function settle() {
+  for (let index = 0; index < 8; index += 1) {
+    await Promise.resolve()
+    await nextTick()
+  }
+}
+
+beforeEach(() => {
+  dashboardApiMocks.getStats.mockReset()
+  dashboardApiMocks.getDailyStats.mockReset()
+  dashboardApiMocks.getDailyStats.mockResolvedValue({
+    daily_stats: [],
+    model_summary: [],
+    period: { start_date: '2026-05-01', end_date: '2026-05-15', days: 15 },
+  })
+})
+
+afterEach(() => {
+  for (const { app, root } of mountedApps.splice(0)) {
+    app.unmount()
+    root.remove()
+  }
+  document.body.innerHTML = ''
+})
+
+describe('Dashboard ordinary user wallet card', () => {
+  it('renders package and wallet balance split from mocked stats', async () => {
+    dashboardApiMocks.getStats.mockResolvedValue({
+      stats: [
+        { name: 'API 密钥', value: '0', subValue: '活跃 0', icon: 'Activity' },
+        { name: '本月请求', value: '0', subValue: '今日 0', icon: 'Users' },
+        {
+          name: '钱包余额',
+          value: '$110.00',
+          subValue: '套餐额度 $100.00 · 钱包余额 $10.00',
+          icon: 'DollarSign',
+        },
+        { name: '本月 Token', value: '0', subValue: '输入 0 / 输出 0', icon: 'Zap' },
+      ],
+      today: { requests: 0, tokens: 0, cost: 0 },
+      cache_stats: { cache_creation_tokens: 0, cache_read_tokens: 0, total_cache_tokens: 0 },
+      token_breakdown: { input: 0, output: 0, cache_creation: 0, cache_read: 0 },
+      monthly_cost: 0,
+    })
+
+    const root = mountDashboard()
+    await settle()
+
+    expect(root.textContent).toContain('$110.00')
+    expect(root.textContent).toContain('套餐额度 $100.00 · 钱包余额 $10.00')
+  })
+})

frontend/src/views/user/__tests__/ModelCatalog.spec.ts

@@ -0,0 +1,69 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { createApp, nextTick, type App } from 'vue'
+
+import type { PublicGlobalModel } from '@/api/public-models'
+import UserModelDetailDrawer from '../components/UserModelDetailDrawer.vue'
+
+vi.mock('@/composables/useClipboard', () => ({
+  useClipboard: () => ({
+    copyToClipboard: vi.fn(),
+  }),
+}))
+
+const mountedApps: Array<{ app: App, root: HTMLElement }> = []
+
+function model(overrides: Partial<PublicGlobalModel> = {}): PublicGlobalModel {
+  return {
+    id: 'gm-test',
+    name: 'gpt-5',
+    display_name: 'GPT 5',
+    is_active: true,
+    default_tiered_pricing: null,
+    default_price_per_request: null,
+    supported_capabilities: ['chat'],
+    config: null,
+    usage_count: 0,
+    ...overrides,
+  }
+}
+
+function mountDrawer(selectedModel: PublicGlobalModel) {
+  const root = document.createElement('div')
+  document.body.appendChild(root)
+  const app = createApp(UserModelDetailDrawer, {
+    open: true,
+    model: selectedModel,
+    'onUpdate:open': vi.fn(),
+  })
+  app.mount(root)
+  mountedApps.push({ app, root })
+  return root
+}
+
+afterEach(() => {
+  for (const { app, root } of mountedApps.splice(0)) {
+    app.unmount()
+    root.remove()
+  }
+  document.body.innerHTML = ''
+})
+
+describe('user model catalog detail drawer', () => {
+  it('does not render model mapping fields for ordinary users', async () => {
+    mountDrawer(model({
+      config: {
+        description: 'User visible description',
+        model_mappings: ['gpt-5-upstream'],
+        provider_model_mappings: [{ name: 'provider-gpt-5' }],
+      },
+    }))
+    await nextTick()
+
+    const text = document.body.textContent || ''
+    expect(text).toContain('GPT 5')
+    expect(text).toContain('User visible description')
+    expect(text).not.toContain('模型映射')
+    expect(text).not.toContain('gpt-5-upstream')
+    expect(text).not.toContain('provider-gpt-5')
+  })
+})